ci: validate site builds on pull requests

[spboyer]

Summary

Add PR-time validation for the documentation site so changes under site/** cannot merge with all required checks green while the Pages build is untested until after merge.

Why

During PR cleanup, site dependency PRs (#446, #462, #468) showed that the required PR checks validate Go and the dashboard, but not the Starlight docs site. The Pages workflow does run npm ci and npm run build, but only on push to main, which means a broken site dependency update would be detected after merge.

Suggested approach

• Add a site build job to an always-reporting PR workflow, or use a path-filter setup with a skip-shim job so required checks do not deadlock on PRs that do not touch site/**.
• Mirror the existing /web validation pattern where possible.
• Run at least cd site && npm ci && npm run build; consider adding the existing site Playwright e2e tests as a follow-up or optional job.

Acceptance criteria

• PRs touching site/**, package-lock.json, or site workflow/config files validate the docs site before merge.
• Non-site PRs still report a successful/skipped site check if the check is required.
• Dependabot site PRs get the same signal before merge that Pages currently provides only after merge.

[github-actions]

🤖 Routed to @copilot (Coding Agent)

Issue: #473 — ci: validate site builds on pull requests

@copilot has been assigned and will pick this up automatically.

The coding agent will create a copilot/* branch and open a draft PR.
Review the PR as you would any team member's work.

[spboyer]

Correction to prior comment (formatting):

Validation update:

• Reproduced at workflow level: site build currently runs in .github/workflows/pages.yml on push to main (and release workflow_run), not on pull_request.
• This means docs-site breakage can bypass required PR checks and only fail post-merge, matching the issue report.

No additional reporter details are needed to validate this issue.

[github-actions]

📋 Marked as release:backlog — assign a release target when ready.

[spboyer]

Triage update: we now have multiple implementation PRs from parallel coding-agent runs. Keeping #476 as the canonical PR for this issue because it uses a dedicated site-ci.yml PR-time validation workflow with path-aware skip behavior and minimal deployment-surface impact. Closing superseded sibling PRs to keep review focused.