Add pull request site build

[Scriptception]

Summary

• build the Zensical site for every pull request with read-only permissions
• keep deployment permissions isolated in the existing main-branch workflow
• pin actions and the site-generator version

Validation

• clean zensical==0.0.50 build in an isolated environment
• workflow YAML parsed locally
• action references verified as 40-character SHAs
• git diff --check