Add deploy workflow as PENDING_ at repo root

This is the GitHub Actions workflow that will build and deploy the
Astro site to GitHub Pages once site-rewrite-astro is merged. Lives
at the repo root with a PENDING_ prefix so it does *not* fire from
this branch — committing the workflow inside .github/workflows/
requires a PAT with the workflow scope, which the bot doesn't have.

To activate it, a maintainer with the workflow scope should:
  git mv PENDING_workflow_site-deploy.yml .github/workflows/site-deploy.yml
  git commit && git push

See the runbook in the PR description for the full cutover sequence
(workflow rename, merge, flip Pages from legacy to workflow build).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: henderkes

PENDING_workflow_site-deploy.yml

@@ -0,0 +1,54 @@
+name: Deploy site to GitHub Pages
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'site/**'
+      - '.github/workflows/site-deploy.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow one concurrent deployment, but cancel any in-flight run when a new push
+# arrives so we don't ship stale content if two pushes land back-to-back.
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: site
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: site/package-lock.json
+      - run: npm ci
+      - run: npm run build
+        env:
+          # Higher rate limit when querying the Releases API at build time.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: site/dist
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4