chore(ci): skip unit work for docs-only pull requests and build www on pull requests - #53314

A pull request that only edits the docs site runs about 5 minutes of unit work that cannot be affected by it, and never builds the site, so a broken docs link passes CI and first fails in deploy-www on v2.

Recent docs-only PRs (#52896, #52780, #52752):

• unit (windows) 228–354 s, unit (linux) 82–128 s: mostly the compiled CLI build and service smoke tests, which run on every PR.
• e2e already skips itself (the app is not affected), typecheck runs astro check for services/www.
• Nothing runs astro build or validate-links.ts.

Changes, pull requests only (push workflows and the deploy-www/deploy-files deploys are untouched):

• test.yml: the affected job sets docs=true when every file the PR changes is under services/www/src/docs/. unit then skips its steps. It skips steps rather than the job, the same way e2e does, so the required unit (linux) and unit (windows) checks still report success. unit now needs: affected; e2e already waits on it, so the overall run is not longer.
• www.yml (new): on PRs to v2 that touch services/www/**, runs bun run build (generate, astro build, pagefind, link validation, Cloudflare prep) without deploying. No secrets needed.
• nix-eval.yml: paths-ignore for services/www/src/docs/** on PRs. It is not a required check.

typecheck still runs for every PR.

Verification:

• The docs-only filter matched a docs-only file list, did not match docs plus a code file, services/www/script/ alone, or an empty list.
• bun run build in services/www succeeds without Cloudflare credentials. With a broken link added to compaction.mdx it fails in validate-links.ts. Neither current PR check catches that.
• This PR changes workflow files, so it takes the full path. The docs-only skip is first exercised by the next docs-only PR.

Requested by: @nexxeln (nexxel via Slack)