Restrict Pages and OIDC permissions to the deploy job

[richardcase]

Problem

The Pages deployment workflow grants pages: write and id-token: write at workflow scope, including the source-controlled build job that runs npm hooks and a third-party Astro Action.

Evidence: https://github.com/richardcase/clowder/blob/b5492d5/.github/workflows/deploy-site.yml#L30-L65

Acceptance criteria

• Give build only the permissions required for checkout/build.
• Grant Pages/OIDC permissions only to deploy.
• Verify the deployment still succeeds and add an actionlint check for the intended scope.