ci: deploy docs/ to Pages via a concurrency-guarded Actions workflow

.github/workflows/pages.yml

@@ -0,0 +1,64 @@
+name: Pages
+
+# Publishes the static marketing/docs site under `docs/` to GitHub Pages.
+#
+# Replaces the auto-generated "pages-build-deployment" (legacy branch/`docs`
+# source), which had no concurrency guard: a burst of pushes to main (e.g. a
+# run of dependabot/dependency-bump merges) each triggered its own Pages deploy,
+# and because GitHub Pages allows only one active deployment they raced and the
+# losers died with the generic `Deployment failed, try again later.` The site
+# stayed live (last successful deploy won) but the Actions tab went red.
+#
+# Two changes fix that: (1) only deploy when the published content actually
+# changes (`paths: docs/**`), so dependency bumps no longer trigger a deploy at
+# all, and (2) the `concurrency` block below serializes the deploys that remain.
+#
+# The content is served verbatim: `docs/.nojekyll` marks it as plain static
+# HTML, so `upload-pages-artifact` uploads the whole `docs/` tree unchanged —
+# identical to what the legacy build served.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+# Least-privilege token plus the two scopes the Pages deployment needs.
+# Actions are pinned to commit SHAs below (supply-chain hardening).
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Serialize deployments to the single Pages environment. A constant group (no
+# github.ref) means every Pages deploy queues behind the previous one instead
+# of racing it; cancel-in-progress: false lets an in-flight deploy finish rather
+# than being cancelled (a cancelled deploy is itself a "try again later" error).
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build artifact
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Upload docs/ as the Pages artifact
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        with:
+          path: docs
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy artifact to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0