Enable site preview for Dependabot builds

We're now building the site via GitHub Actions and pushing that to Cloudflare Pages ourselves to deploy the site, following #921.

This requires secrets to deploy. Dependabot does not have access to these secrets (#929). #930 simply skips the publish step for Dependabot PRs, which means you don't get an automatic preview. This isn't too big a problem as most changes are likely fairly innocuous, provided the site builds.

If we want to resolve it, we would either need to:

• use pull_request_target as the workflow trigger (⚠️ which has security implications which we would be better avoiding)
• or (probably better) separating build and deploy steps by building the site and uploading artifacts in one workflow, then triggering deployment of those artifacts via workflow_run, with secrets access.

Alternatively, if Cloudflare Pages ever improves to allow builds with newer Python, we could consider allowing Cloudflare Pages to do the build and deploy. This removes this problem.

Review the GitHub Actions workflow introduced by #921 and the Dependabot secret limitation described in #929. Compare separating the build and artifact upload from deployment via workflow_run with the other options, including their security implications. Done means Dependabot pull requests receive site previews without exposing deployment secrets.