ci: split Windows build and site validation

.github/workflows/ci.yml

@@ -196,12 +196,11 @@ jobs:
         with:
           node-version: ${{ env.PRIMARY_NODE_VERSION }}
 
-      - name: Enable corepack (pnpm)
-        run: corepack enable
-
-      - name: Resolve pnpm store path
+      - name: Enable corepack and resolve pnpm store path
         id: pnpm-store
-        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+        run: |
+          corepack enable
+          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache@v4
         with:
@@ -272,12 +271,11 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
 
-      - name: Enable corepack (pnpm)
-        run: corepack enable
-
-      - name: Resolve pnpm store path
+      - name: Enable corepack and resolve pnpm store path
         id: pnpm-store
-        run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
+        run: |
+          corepack enable
+          echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache@v4
         with:
@@ -310,8 +308,9 @@ jobs:
       - name: Run complete keyless Python suite
         run: uv run --python 3.10 --group test --project python/sdk pytest
 
-  # Blocking Windows build lane: keep the already-green native build protected
-  # while the broader observational gate matrix below exposes the remaining
+  # Blocking Windows build and production-site lanes keep the already-green
+  # native outputs protected without putting both critical paths in one job.
+  # The broader observational gate matrix below exposes the remaining
   # portability work without blocking mainline merges.
   windows-build:
     if: github.event_name != 'workflow_dispatch'
@@ -324,15 +323,30 @@ jobs:
         with:
           node-version: ${{ env.PRIMARY_NODE_VERSION }}
 
-      - name: Enable corepack (pnpm)
-        run: corepack enable
-
       - name: Install (immutable)
-        run: pnpm install --frozen-lockfile
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
 
       - name: Build (tsc -b + tsdown)
         run: pnpm run build
 
+  windows-site:
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: windows-2025
+    name: windows / production site
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.PRIMARY_NODE_VERSION }}
+
+      - name: Install (immutable)
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+
       - name: Build documentation site (production SPA)
         run: pnpm run docs:build
 
@@ -402,14 +416,12 @@ jobs:
         with:
           node-version: ${{ env.PRIMARY_NODE_VERSION }}
 
-      - name: Enable corepack (pnpm)
-        shell: pwsh
-        run: corepack enable
-
-      - name: Resolve pnpm store path
+      - name: Enable corepack and resolve pnpm store path
         id: pnpm-store
         shell: pwsh
-        run: '"path=$(pnpm store path --silent)" >> $env:GITHUB_OUTPUT'
+        run: |
+          corepack enable
+          "path=$(pnpm store path --silent)" >> $env:GITHUB_OUTPUT
 
       - uses: actions/cache@v4
         with:
@@ -544,7 +556,7 @@ jobs:
   all-checks-passed:
     name: all checks passed
     runs-on: ubuntu-latest
-    needs: [node-24, node-compat, python-sdk, windows-build]
+    needs: [node-24, node-compat, python-sdk, windows-build, windows-site]
     if: always() && github.event_name != 'workflow_dispatch'
     steps:
       - name: Fail if any needed job did not succeed