Consolidate GitHub Actions workflows

[nscuro]

• Moves lint jobs into a single workflow.
• Separates building from linting.
• Assigns proper names to all jobs so they're usable in GitHub branch protection rules.

[Copilot]

Pull request overview

This PR consolidates and clarifies CI responsibilities by separating linting and build checks into dedicated GitHub Actions workflows, and by giving jobs stable names suitable for branch protection rules.

Changes:

• Refactors lint.yml into separate “Docs” and “GitHub Actions” lint jobs.
• Removes PR lint/build steps from deploy.yml, keeping it focused on push/tag deployments.
• Introduces a new build.yml workflow to run make build on pull requests.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/lint.yml	Splits linting into distinct jobs for docs/prose/YAML and for GitHub Actions (zizmor).
.github/workflows/deploy.yml	Simplifies deploy workflow by removing PR-only lint/build job; keeps deploy on pushes/tags.
.github/workflows/build.yml	Adds a dedicated PR build workflow running make build.

Comments suppressed due to low confidence (2)

.github/workflows/lint.yml:33

• lint-docs runs actions/checkout, but this workflow sets permissions: {} at the top level, so the job currently has no contents: read permission and checkout will fail. Also, compared to the previous PR lint job in deploy.yml, PRs no longer run make lint-python, which is likely an unintended regression given the PR description about consolidating lint jobs.
  .github/workflows/deploy.yml:22
• on.push.tags patterns are glob-style, not regex. The current patterns include +, which is treated literally and will not match typical SemVer tags like 1.2.3 (it would match 1+.2+.3+ instead), so tag-based deploys likely won’t trigger.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.