ci(docs): decouple Pages from Bulletin

[Imod7]

Description

docs-deploy.yml publishes to the Bulletin Chain then GitHub Pages in one job, with nothing shielding the Pages steps from a Bulletin failure. Three release deploys failed at Bulletin and published nothing, so the public site has served the 0.21.0 build since 2026-08-07 against a main at 0.27.0. This makes the two targets independent and fixes both causes.

Changes

.github/workflows/docs-deploy.yml

• Bulletin step is continue-on-error and a final step re-raises its outcome. Pages publishes either way, the run still goes red.
• The gate moves to its own job. Twelve per-step conditions go away, a run that deploys nothing reports skipped instead of success, and the deploy checkout is pinned to the gated SHA.
• bulletin-deploy 0.15.2 to 0.17.1. 0.15.2 predates the 2026-09-01 DotNS ABI change and calls a PopRules.startingPrice() that no longer exists on paseo-next-v2, which is what the 09-01 and 09-03 runs failed on.
• Retry budget 3 x 10 to 2 x 30 minutes. Same ceiling, but one attempt can now finish the 66.5 MB upload that timed out on the two 08-27 runs.

.github/scripts/check-docs-deploy.sh (new): the guard from docs-verify.yml, now runnable locally, plus assertions that the two properties above cannot be undone silently.

Testing

The deploy runs only on a release or a dispatch, so the guard is what is testable.

git show main:.github/workflows/docs-deploy.yml > /tmp/before.yml
bash .github/scripts/check-docs-deploy.sh /tmp/before.yml   # exit 1, three errors
bash .github/scripts/check-docs-deploy.sh                   # exit 0

Nothing under product-sdk/ changes, so the SDK and e2e suites are path-filtered out of this PR.

Nothing here runs on push. The site updates on the next release, or now with gh workflow run "docs: Deploy (Bulletin + Pages)" --repo paritytech/product-sdk --ref main. Pages publishes even if Bulletin still fails.