ci(docs): build on pull requests, so a toolchain bump has to prove itself

[tannevaled]

The docs workflow ran only on push to main and on workflow_dispatch, so a pull request touching mkdocs.yml, the prose or requirements.txt produced no check at all.

That is why four dependency pull requests have sat here since 2026-07-09 — #5, #6, #7, #8. Nothing could say whether mkdocs-material 9.7.7 or Python 3.14 still builds this site, so there was no basis on which to merge them. They were not neglected; they were unverifiable.

This splits the job in two:

• build runs on every pull request and on main, with mkdocs build --strict so a broken link or an unknown config key fails instead of warning into the void.
• deploy keeps the mike publish, gated to push / workflow_dispatch, so a pull request stops after the build and never touches gh-pages.

This is a pilot: 50 of the 51 */docs repositories have the same workflow with the same gap, and 164 dependency pull requests are waiting on them. If this shape works here it is worth rolling out to the rest.

🤖 Generated with Claude Code