ci: build the website on pull requests

[janicduplessis]

Description

The website build ran only in docs.yml on push to main, so a pull request that broke MDX under website/docs/ merged green and failed the Docs deploy afterward (#1839, fixed by #2057).

Solution

docs.yml now also triggers on pull_request with the same path filter as the push trigger, which includes the workflow file itself. The existing build job runs on pull requests. The deploy job is skipped on pull requests, and the concurrency group is per ref for pull requests so they do not queue behind Pages deploys. The pages: write and id-token: write permissions move from the workflow to the deploy job, so PR builds run with read-only permissions.

Test plan

• The Docs workflow runs on this pull request because it edits docs.yml.
• A temporary commit adds a bare <Foo> to a doc; the Docs build must fail. The commit is then reverted and the build must pass.

Fixes #2058

[janicduplessis]

Review of the docs.yml change. No blocking issues found.

Checked and correct:

• Deploy gating: deploy is skipped on pull_request, so no github-pages environment run, deployment or protection prompt occurs on PRs. push and workflow_dispatch still deploy.
• Concurrency: on push, dispatch and schedule the expression evaluates to docs-pages, the same group as before, so main deploys still serialize. PRs get docs-refs/pull/N/merge. cancel-in-progress: false holds one running plus one pending run per PR (older pending runs are replaced), which is fine.
• Fork PRs: the workflow-level pages: write / id-token: write do not fail a fork run. GITHUB_TOKEN is capped to read-only there, and build only needs contents: read for checkout. No secrets are used.
• Path filter: the pull_request filter matches the push filter. The build's inputs are website/**, docs/releases/** (gen-changelog.mjs) and packages/stim-cli/src/guide/errors.ts (gen-troubleshooting.mjs, which imports only ./types.ts), all covered.
• Artifact upload on PRs: upload-pages-artifact runs on PRs. It is harmless (per-run artifact, deploy skipped).

Minor, non-blocking:

1. The workflow declares pages: write and id-token: write at the top level, so the PR build job holds them on same-repo PRs, which run PR-controlled code (pnpm install, docusaurus build). No secret is exposed and the token cannot deploy without the deploy job. Moving those two permissions to the deploy job (top-level contents: read) would follow least privilege, but that is optional here.
2. The path filter means the check does not report on PRs that touch none of those paths. Nothing is required today (main has no required status checks, only a ruleset with deletion and non_fast_forward), so nothing blocks. If Docs is made a required check later, the skipped-by-filter case would hang merges.
3. The website build can also be affected by files outside the filter only if website/ starts importing further from elsewhere. The packages/stim-cli/src/guide/** filter is broader than needed (only errors.ts is imported), which is safe.
4. The upload-pages-artifact step could be gated with if: github.event_name != 'pull_request' to avoid uploading an unused artifact on every PR run. Optional.

The test plan (bare <Foo> failing the build) is enough to confirm the new gate.