ci: publish the docs site to Pages instead of discarding the build

[shbmx]

The problem

The docs job builds the documentation site and throws it away. Nothing is
uploaded, nothing is deployed — so https://shubham030.github.io/moth/, the
URL the site declares for itself in website/docusaurus.config.ts, returns
404. Every docs link in the README points at a page that has never existed.

Found while checking what a first-time reader actually sees when they follow
the links from the repo.

What changed

• docs uploads the built site as a Pages artifact, on every run
  including pull requests. The deploy job can therefore only publish bytes
  that this job already built and checked.
• New deploy-docs job, gated on push to main. Building and
  publishing stay separate deliberately: a PR proves the site still compiles
  — onBrokenLinks: 'throw' means a dead link fails there — without
  replacing what readers see.
• concurrency: pages, cancel-in-progress: false so two pushes queue
  instead of racing, and the last commit on main is what ends up live.
• configure-pages with enablement: true creates the Pages site on the
  first run and is a no-op afterwards, so publishing needs no manual step in
  Settings.

Scoped to .github/workflows/ci.yml; no other file is touched.

Test plan

• make test on this branch: 84/84 passing, render perf: all budgets held, serial PTY round-trip exact. Unaffected by this change, but recorded
  since the test job shares the workflow file.
• Workflow parses: yaml.safe_load resolves three jobs (test, docs,
  deploy-docs) with the intended needs, if, permissions and
  concurrency keys.
• The deploy path cannot be exercised from a pull request by construction —
  the if guard excludes pull_request. Verification is the first push to
  main after merge: deploy-docs should go green and
  https://shubham030.github.io/moth/ should return 200.

Note

GitHub Pages on a private repository needs a paid plan. This repo is public,
so the free tier covers it — but the deploy would have failed silently while
it was private, which is worth knowing if visibility ever changes back.