Build and deploy docs from CI and add a pass/fail check the org ruleset can require

[nbrownus]

Nothing in CI built the site, the Cloudflare Pages integration did, so a PR that broke the build still went green. This adds a build job that runs on every PR, forks included, and a deploy job that publishes it with wrangler, main to production and every other branch to a preview. Fork PRs don't get secrets, so they build but skip the deploy. A pass/fail check job depends on every other job so the Required CI ruleset has one check to require.

Uses the org CLOUDFLARE_API_TOKEN secret. Once this is merged and main has deployed from CI, turn off automatic deployments on the docs-nebula Pages project so it stops building twice.

[cloudflare-workers-and-pages]

Deploying docs-nebula with    Cloudflare Pages

Latest commit:	f545595
Status:	✅  Deploy successful!
Preview URL:	https://0ea112c2.docs-nebula.pages.dev
Branch Preview URL:	https://ci-status-gate.docs-nebula.pages.dev

View logs

[github-actions]

✅ Deploy Preview for docs-nebula ready!

Name	Link
🔨 Latest commit	8adcfff
🔍 Latest deploy log	https://github.com/DefinedNet/nebula-docs/actions/runs/35892269774
😎 Deploy Preview Url	https://46cc975d.docs-nebula.pages.dev
😎 Deploy Preview Alias	https://ci-status-gate.docs-nebula.pages.dev

---

[jasikpark]

LGTM!

praise: The fork guard on deploy plus the separate build job means fork PRs still get a real build check, and a skipped deploy doesn't trip pass/fail check.

suggestion (non-blocking): The workflow-level concurrency group falls back to github.sha on push, so pushes to main never share a group and their production deploys can race (older finishing last wins). A job-level group on deploy would queue them in order:

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false

nitpick (non-blocking): upload-artifact / download-artifact are pinned at v4 while the rest of the file is on v6-era pins.

nitpick (non-blocking): If the build fails, the PR comment stays on "building..." until the next push (same as webclient), and the new jobs have no timeout-minutes.

question (non-blocking): Is docs-nebula's production branch set to main in Pages? Worth confirming the first CI deploy from main lands as production before turning off the git integration.

— Caleb + Cache

[jasikpark]

LGTM, thanks for picking up the concurrency group and timeouts!

nitpick (non-blocking): The comment above GTAG_TRACKING_ID in docusaurus.config.ts still calls it a CF Workers environment variable. It comes from the Actions variable now.

— Caleb + Cache