Move the docs build and Void deploy out of ci.yml into a dedicated
deploy-website.yml workflow.

Docs are validated on every PR/merge-queue run. On main the site is
deployed only when the rendered output actually changes: a content
fingerprint of the git-tracked docs sources plus the generated TypeDoc
reference (docs/reference) is compared against an actions/cache marker
keyed by that hash, so a packages/rolldown/src change that does not
affect the public API produces the same reference and is skipped.
workflow_dispatch force-deploys.

Drops the docs-changes detection and the docs-validation/deploy-void
jobs from ci.yml.

…d steps

The merged job carried environment: void while running build/validation
steps on PRs, so a malicious PR could materialize VOID_TOKEN in those
steps. Split back into two jobs:

- docs-validation: builds/validates and computes the deploy decision
  (content fingerprint + cache marker lookup). No environment, no secret.
- deploy-void: environment: void; runs only on main and only when
  docs-validation says a deploy is needed. Does nothing but checkout +
  setup + deploy, so VOID_TOKEN is in scope only for the deploy step and
  unchanged content never enters the void environment.

Build the full site for HEAD and HEAD^ and diff the dist; deploy only when
it changed (or on workflow_dispatch). This compares the actual rendered
output instead of the generated reference, so source changes that don't
affect the site are skipped.

The dist diff requires reproducible builds. vitepress-plugin-group-icons
emitted the [data-title] selectors within each CSS rule in unstable order
(file-transform order), which changed the CSS hash and cascaded to every
HTML page; patch it to sort the selectors. With that, two builds of the
same commit are byte-identical except the generated llms*.txt aggregations,
which the diff excludes (real content changes still show up in the HTML).

No GitHub Actions cache is used. A failure building the previous commit
falls through to deploying.

Pick the diff baseline by context: on main compare the built site against
the previous commit; on a PR compare against the target branch (main, fetched
shallowly). The comparison now also runs on PRs as an informational signal
(written to the job summary); deploy stays main-only.

Build the full site for the current ref and the baseline (previous commit on
main, target branch on a PR) and diff the dist. The build isn't byte-reproducible
(vitepress-plugin-group-icons emits unstable CSS selector/rule ordering, which
cascades into the asset hash; vitepress-plugin-llms reorders llms*.txt), so both
dists are normalized before diffing via scripts/misc/normalize-docs-dist.mjs:
canonicalize the CSS, de-hash the CSS filename/refs, and drop llms*.txt. The
deploy still ships the real build.

Verified: two builds of the same commit normalize to an identical tree, and a
real content change is still detected. No dependency patch, no Actions cache.

After the full-clone fix, the only residual diff was assets/style.css. The
canonicalizer is order-invariant (proven: 4 builds canonicalize to one hash),
so a residual diff means the group-icons CSS content itself differs between CI
builds (the label collection races). Drop the [data-title] rules from the CSS
comparison entirely; the rest of the CSS is deterministic. Verified locally:
same-commit builds normalize identical, real content change still detected.