Publish the API docs from main, not only on a v* tag

[wxiao0421]

Summary

roblox.github.io/Sentinel returns 404 — the Sphinx site has never been published. The job that deploys it, publish-docs, lives in publish.yml, which triggers only on a v* tag, and this repository has no tags and no releases, so that workflow has never run. Meanwhile docs.yml carries pages: write, id-token: write and a "pages" concurrency group it never uses.

This moves the deploy job into docs.yml on pushes to main, so the site tracks the code rather than waiting on a release that may never be cut.

The job as written would have published an empty site

Flagging this separately because it isn't obvious. autodoc imports the package to read its docstrings, sentinel_local_index imports sentence_transformers at module level, and sentence_transformers is an optional extra. So poetry install --with docs leaves all ten modules unimportable — and sphinx-build still exits 0:

install	build/html/sentinel.html	autodoc import failures
--with docs	18 KB, headings only	10
--with docs --extras sbert	270 KB, full API	0

Both jobs now install --extras sbert, and both build steps fail if the log contains failed to import, so an empty site cannot ship unnoticed. The pull request job also builds the HTML now; it previously regenerated only the RST, so nothing ever checked that the site builds at all.

Arguably sentinel_local_index should import sentence_transformers lazily, given the extra is declared optional. Left alone here as a separate concern.

Other changes

• publish.yml keeps the package path only, with publish-pypi depending on build directly.
• Deployments take the "pages" group with cancel-in-progress: false, so a docs check on another branch cannot cancel a deployment in flight. The workflow-level group is now per branch.
• .gitignore covers docs/build/, the output directory docs/README.md tells you to open.

Test plan

• Built locally with poetry install --with docs --extras sbert and sphinx-build -b html source build/html: build succeeded, no import failures, 270 KB sentinel.html containing the real API
• Reproduced the empty build without the extra: 10 import failures, 18 KB of bare headings
• Guard checked in both directions, against a real import-failure log and a passing build
• docs/generate_docs.py leaves docs/source/ clean, so the existing sync check still passes
• Reviewer: merging this performs the first Pages deployment; Pages is already configured for workflow builds, so no repository settings change is needed
• Unrelated, not fixed here: build and publish-pypi still use actions/upload-artifact@v3 and download-artifact@v3, retired in January 2025, so tagging a release would fail before reaching PyPI