Make CI a check, not a deployment

The workflow targeted GitHub Pages, which this repository cannot use while it is
private on a plan without it - so every push would have failed at the deploy
job. Deployment is manual and tied to a phyphox release anyway.

What remains is the part that has value: mkdocs build --strict on every push and
pull request, which now also rejects a broken heading anchor, an invalid
openapi.yaml, an inconsistency id that does not exist, and anything that would
make a visitor's browser fetch from a third party. The rendered site is uploaded
as a short-lived artifact so a reviewer can look at it without it being
published anywhere.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Staacks

.github/workflows/build.yml

@@ -0,0 +1,44 @@
+name: Build documentation
+
+# Checks only - nothing is published from CI. The site is deployed to
+# phyphox.org by hand, alongside a phyphox release; see README.md. GitHub Pages
+# is not an option anyway while this repository is private and the plan does not
+# include it, and a deploy job that cannot succeed is worse than none.
+#
+# `mkdocs build --strict` is not just a build. Via tools/hooks.py it also fails on
+#   - a broken internal link or heading anchor,
+#   - an invalid openapi.yaml,
+#   - an {{inconsistency:...}} marker or x-phyphox-inconsistency naming an id that
+#     is not in inconsistencies.yml,
+#   - anything in the generated site that would make a visitor's browser fetch
+#     from a third party.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - run: pip install -r requirements.txt
+      - run: mkdocs build --strict
+
+      # Lets a reviewer download the rendered site from the run without anything
+      # being published. Retention is short because it is a preview, not a
+      # release artifact.
+      - uses: actions/upload-artifact@v4
+        with:
+          name: site
+          path: site/
+          retention-days: 7

.github/workflows/deploy.yml

@@ -32,6 +32,24 @@ navigation entries into errors, so build that way before pushing:
 .venv/bin/mkdocs build --strict
 ```
 
+## Deploying
+
+The site is **not** published from CI. `mkdocs build --strict` runs on every push
+and pull request as a check, and uploads the rendered site as a downloadable
+artifact, but nothing is deployed.
+
+Deployment is a manual step taken alongside a phyphox release, so that the
+documentation and the app it describes ship together:
+
+```bash
+.venv/bin/mkdocs build --strict
+rsync -avz --delete site/ <user>@phyphox.org:/var/www/docs/
+```
+
+`site_url` in `mkdocs.yml` is already set to `https://phyphox.org/docs/`; change
+it if the site moves, or search links and the sitemap will point at the wrong
+host.
+
 ## Layout
 
 ```