Add reusable remote docs preview workflow

[Blargian]

Adds a reusable remote documentation preview workflow. A constrained pull_request_target caller pins that pull request's exact head SHA and directly creates a Vercel deployment of trusted Nimbus main in the connect-preview Custom Environment.

A maintainer can get a docs preview by adding the docs-preview label - this is done both to save unnecessary preview builds and to ensure there's a gate on what code gets run. JS can run inside of MDX so there is a security concern there:

• This workflow triggers a Vercel build, passing the repo and PR ref
• The docs site uses a Vercel Connect app with a short-lived token to pull the docs from that PR
• Docs build inside the Vercel environment
• The workflow polls for the deployment status and updates a comment with the public preview link

I have taken care to separate out MDX processing from the part of the build process which fetches the docs content from remote sources. The label acts as gate keeping mainly for community PRs.

The Actions workflow never checks out or executes pull-request content and never passes a GitHub credential into Vercel. During the build, Vercel Connect exchanges the deployment OIDC identity for a short-lived contents:read token scoped to the selected source repository. The workflow waits for completion, cancels superseded deployments, and posts a sticky preview link on the source pull request.

Callers receive VERCEL_TOKEN, VERCEL_ORG_ID, and VERCEL_PROJECT_ID through organization Actions secrets. A copy-paste caller and configuration documentation are included. Each caller can use the native paths filter to select which changes are eligible, for example docs/**. A new PR commit requires a new label event, so approval remains bound to the SHA selected when the label was added.

Changelog category (leave one):

• CI Fix or Improvement (changelog entry is not required)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

Not for changelog.

Registering a remote source

Before installing the caller, add an entry to remotes.json in ClickHouse/mintlify-docs-dev. Set name to the value passed as remote_name, repo to the source repository, path to its documentation directory, and mount to its destination relative to /docs. Add assets mappings and private: true when required. Do not pin a branch in the registry: production reads the source's default branch, while an approved preview supplies the exact pull-request SHA.

[Blargian]

Disclaimer:

This works for a custom Astro build of the docs (https://clickhouse-docs.vercel.app/docs). It's not actually triggering a Mintlify deploy. The two sites are visually and functionally identical though so we can use this for now as a work around for Mintlify's short-comings.