ci(docs): always trigger docs workflow on PRs; move filtering into workflow (#1544)

* ci(docs): always trigger on PRs, move file filtering into workflow

- Drop the `paths` trigger filters so the docs workflow always runs
  on pull requests (and pushes) and reliably reports its check status.
- Add a `changes` job using dorny/paths-filter@v3 to detect doc-related
  changes inside the workflow with recursive globs (`flaml/**`,
  `website/**`, `.github/workflows/deploy-website.yml`).
- Gate `checks` and `gh-release` on the filter output so the heavy
  steps are skipped when no doc-related files changed, while
  `workflow_dispatch` (and `merge_group` for `checks`) can still
  force a run.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(docs): grant pull-requests:read for dorny/paths-filter, scope contents:write to deploy

Address review: dorny/paths-filter@v3 calls the GitHub PR Files API on
pull_request events and needs `pull-requests: read`. Without it, the
`changes` job can fail with 403 on PRs and block downstream jobs via
`needs: changes`.

- Drop workflow-level `contents: write`; default to least-privilege
  `contents: read` and add `pull-requests: read` so the filter can read
  PR file lists.
- Move `contents: write` to the `gh-release` job only, where
  peaceiris/actions-gh-pages needs it to push to the gh-pages branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(docs): keep workflow-level contents:write, only add pull-requests:read

Per review feedback, restore `contents: write` at the workflow level
(needed by gh-release for peaceiris/actions-gh-pages to push to
gh-pages) and just additively grant `pull-requests: read` so
dorny/paths-filter@v3 can read PR file lists via the GitHub API.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: thinkall <thinkall@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: thinkall

.github/workflows/deploy-website.yml

@@ -3,26 +3,35 @@ name: docs
 on:
   pull_request:
     branches: [main]
-    paths:
-      - 'flaml/*'
-      - 'website/*'
-      - '.github/workflows/deploy-website.yml'
   push:
     branches: [main]
-    paths:
-      - 'flaml/*'
-      - 'website/*'
-      - '.github/workflows/deploy-website.yml'
   workflow_dispatch:
   merge_group:
     types: [checks_requested]
 
 permissions:
   contents: write
+  pull-requests: read
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      docs: ${{ steps.filter.outputs.docs }}
+    steps:
+      - uses: actions/checkout@v3
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            docs:
+              - 'flaml/**'
+              - 'website/**'
+              - '.github/workflows/deploy-website.yml'
+
   checks:
-    if: github.event_name != 'push'
+    needs: changes
+    if: github.event_name != 'push' && (needs.changes.outputs.docs == 'true' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group')
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -58,7 +67,8 @@ jobs:
           npm run build
           fi
   gh-release:
-    if: github.event_name != 'pull_request'
+    needs: changes
+    if: github.event_name != 'pull_request' && (needs.changes.outputs.docs == 'true' || github.event_name == 'workflow_dispatch')
     runs-on: ubuntu-latest
     defaults:
       run: