Fix the PR preview workflow in eclipse-score/eclipse-score-website.

[b-rei]

Context:

• PR Redesign the Eclipse S-CORE website eclipse-score-website#76 is from b-rei:website_update into main, with head commit ef8a2ad801eb0cb62d0d6bb7ecb8d7d0591861bf.
• The workflow is .github/workflows/preview.yml. It listens to both pull_request and pull_request_target.
• The Build and Archive job succeeded, but the live preview at https://eclipse-score.github.io/eclipse-score-website-preview/pr-preview/pr-76/ still serves the old site.
• The preview deployment branch is still at cdf2f755acd924fa7ac37b670bc20dde62808250, which contains the legacy page.
• The deploy job also fails when marocchino/sticky-pull-request-comment posts its comment: “Resource not accessible by integration.” The job currently grants pull-requests: write but not issues: write.
• The build in b-rei:website_update works and can be reviewed here: https://b-rei.github.io/eclipse-score-website/

Please implement a secure fix, not just describe one:

1. Ensure previews are built from the PR’s proposed changes and the resulting artifact is what gets published.
2. Do not check out or execute PR code in a privileged pull_request_target job. Prefer an unprivileged pull_request build followed by a privileged deployment that downloads the artifact from that exact successful workflow run. Validate the triggering repository, workflow, PR number/status, and head SHA before publishing; do not execute files from the artifact.
3. Fix the preview comment permission with the minimum required token permissions, including issues: write where the workflow posts PR issue comments.
4. Preserve preview cleanup when a PR closes, avoid duplicate/racing deployments from the two event types, and keep the existing preview URL/repository behavior.
5. Add or update validation as appropriate.

Acceptance criteria:

• The PR 76 preview URL shows the redesigned website, including the new contributor-training link, rather than legacy content.
• The build and deployment are successful, and the preview comment succeeds.
• No privileged job checks out or runs code from the PR.

Note: The workflow change must reach the upstream repository’s main branch to affect pull_request_target runs. Do not “fix” this by only adding issues: write or by checking out the PR head inside pull_request_target.