ci: validate docs on PR and only deploy Pages on release

[adrianhall]

Closes #562

Summary

build-docs.yml had no PR validation and republished the live GitHub Pages
site on every merge to main, per #562.

• Add a pull_request trigger (and keep push: main, for parity) that runs
  a new validate job:
  • mkdocs build --strict -f ./mkdocs.production.yml to catch broken
    internal links/anchors/nav entries.
  • lycheeverse/lychee-action
    to catch dead external links in docs/**/*.md.
  • Never deploys.
• Gate the deploy job to release: published (or a manual
  workflow_dispatch against a release tag), matching the
  build-library.yml/build-template.yml convention, instead of deploying
  on every push to main.
• --strict is only used in the new CI-only validate job — not baked into
  mkdocs.production.yml or used by the build job that feeds deploy — so
  a stray warning can never block the artifact that actually gets published.
• Move the Pages-specific permissions (pages: write, id-token: write),
  the pages concurrency group, and the configure-pages step down to the
  deploy job only, so PR/push validation runs stay fork-PR-safe and don't
  need elevated Pages permissions.
• Fix every broken link/anchor the new checks surfaced:
  • A stale self-referential anchor link to a since-renamed doc page.
  • Two dead links to a GitHub user profile that no longer exists (kept the
    attribution text, dropped the dead hyperlink).
  • A doc link to a test-infra file (tests/infra/databases/cosmos.bicep)
    that no longer exists; repointed to the equivalent bicep module in the
    Cosmos DB sample.
  • A doc link to a MySQL test context class that no longer exists (removed;
    the page already notes MySQL is no longer tested as of v10.0.0).
  • A moved "Azure Cosmos DB for MongoDB (vCore)" Microsoft Learn URL.
  • An outdated Auth0 quickstart URL (old multi-page quickstart structure).
  • A URL with a missing / (learn.microsoft.comaspnet/...).

Verification

• mkdocs build --strict -f ./mkdocs.production.yml — clean.
• mkdocs build -f ./mkdocs.yml (local dev config, unaffected by the
  strict-mode change) — clean.
• lychee against docs/**/*.md (with a browser-like user agent to avoid
  bot-blocking false positives on a couple of hosts) — 0 errors.
• actionlint on .github/workflows/build-docs.yml — clean.
• No src/**, tests/**, templates/**, or samples/** paths changed, so
  none of build-library.yml/build-template.yml/build-samples.yml
  apply. build-docs.yml itself was intentionally not dispatched on the
  fork ahead of this PR, since its current deploy job is unguarded — the
  fix will get its first live validation from this PR's own
  pull_request-triggered run.