ci: block PR merge on a broken docs-site build

[joshua-temple]

Problem

The docs site build ran on PRs (in docs-deploy.yaml) but its result could not block a merge: it lives in a separate workflow, and cross-workflow needs is impossible, so a broken Astro build could still merge. Making a path-filtered docs check required directly would deadlock non-docs PRs, which never report that status.

Fix

• Add a skip-tolerant docs-build job to pr.yaml, gated on a docs path filter, and wire it into the already-required PR Gate. Non-docs PRs skip it and the gate stays skip-tolerant, so no deadlock. A failing docs build now fails the gate and blocks the merge.
• Make docs-deploy.yaml push-only so the PR-time build is not duplicated; PR-time build validation now lives in the gate. The build and deploy jobs are otherwise unchanged.

Verification

• actionlint clean on both workflow files.
• npm ci + npm run build succeed in docs/ under Node 22 (23 pages built), proving the new gate job's commands.