ci(deploy): remove Pages build steps and limit permissions to worker deployment

.github/workflows/deploy.yml

@@ -5,53 +5,19 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# The Worker only. The docs site is built and published from prdlk/cs, which
+# reads docs/ from this repo over HTTP (Blume's mdxRemote()), so this repo has
+# no Pages build.
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # The Worker deploy is idempotent (wrangler uploads the whole bundle), so on a
-# burst of pushes only the last one matters: cancel-in-progress is correct for
-# both the Pages build and the Worker job.
+# burst of pushes only the last one matters: cancel-in-progress is correct.
 concurrency:
   group: deploy
   cancel-in-progress: true
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22 # Blume requires 22.12+
-
-      - uses: oven-sh/setup-bun@v2 # skip if you use npm/pnpm
-
-      - run: bun install --frozen-lockfile
-      # pages/changelog.astro reads this repo's GitHub releases at build time
-      # (apps/docs/lib/releases.ts). The token authenticates that fetch —
-      # required if the repo is private, and it lifts the shared runner's
-      # unauthenticated API rate limit. `contents: read` covers it.
-      - run: bun run build
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: apps/docs/dist
-
-  deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - id: deployment
-        uses: actions/deploy-pages@v4
-
   # Deploys on every main push (not path-filtered): apps/api/data/schedule.json
   # is bundled at deploy time, and re-deploying an unchanged Worker is a no-op.
   # Needs repo secrets CLOUDFLARE_API_TOKEN (Workers Scripts: Edit),