[crandmck]

Summary

• Validate candidate api-docs/versions.json independently of the contributor trust gate, using the base branch's existing validator with read-only permissions and without importing candidate Python code.
• Preserve the full docs build's trust gate, but add an always-running Documentation checks job that fails unless configuration validation and the build both succeed. Reevaluate when labels are removed as well as added.
• Upload generated HTML as the versioned-api-documentation artifact.
• Add regressions for the checked-in version configuration and malformed JSON; document CI authorization and the required status check.

Validation

• Existing Python tooling tests plus malformed-JSON regression: 10 passed.
• Checked-in configuration regression: correctly fails on the existing malformed api-docs/versions.json; separately verified acceptance of valid configuration and rejection of the original malformed structure using temporary fixtures.
• JavaScript selector tests: 6 passed.
• Executed the workflow's actual configuration-validation command against valid, malformed, empty, duplicate, invalid-tag, non-string and missing configurations; candidate Python code was not imported.
• Executed the final gate for all 16 combinations of success/failure/skipped/cancelled results; only two successes pass.
• Workflow YAML parsed and git diff --check passed. Actionlint is not installed; no full site build was attempted because the existing configuration is malformed.

Merge requirements

This intentionally does not change api-docs/versions.json; its correction belongs to the separately requested fix. The new configuration check will remain red until that correction is included in this branch or the PR merge commit.

A repository administrator must configure branch protection or repository rules to require Documentation checks. This PR adds the check but does not change repository settings. Untrusted PRs still need a maintainer to apply safe to test for the full build.

Related incident: #288.