Add GitHub Pages PR previews

[johnnygreco]

Summary

• build documentation previews for pull requests that change documentation inputs
• publish trusted internal-branch previews under /pr-preview/pr-<number>/
• update one sticky PR comment with the deployed preview URL and revision
• remove previews when documentation changes are reverted or the PR closes
• preserve active previews during production documentation deployments

Security and reliability

PR-controlled builds run with read-only credentials and pass static output to a
trusted default-branch deployment workflow. Fork and Dependabot pull requests
validate but cannot publish active content on the production Pages origin.

Production and preview updates share a queued deployment group, stale revisions
are rejected, failed updates mark existing preview comments as stale, and the
branch-deployment action is pinned to a reviewed commit.

The existing GitHub Actions Pages source remains unchanged. The first production
deployment after merge creates the composite gh-pages storage branch
automatically. This bootstrap PR cannot preview itself because the trusted
workflow_run workflow must first exist on main.

Validation

• python3 tests/test_render_dev_notes.py
• scripts/build-docs.sh
• actionlint 1.7.12, ignoring only its lack of support for GitHub's newer
  concurrency.queue key
• YAML parsing and syntax checks for all six embedded JavaScript blocks
• git diff --check
• local Zensical server returned HTTP 200
• independent correctness, security, and maintainer review panels reported clean