fix: unchain merge-tags:generate from docs:generate -- it broke the Pages deploy

docs:generate runs inside .github/workflows/deploy.yml, so appending a step that
hard-fails without MERGE_TAGS_TOKEN took the entire site build down with it: run
32555981823 failed on "no token" where the previous deploy had succeeded. My
change, my mistake.

The fetcher still fails loudly -- that is right for the artifact, because an
empty catalog renders as a product with no merge tags. It is not right for it to
decide whether every other page on the site ships.

It stays an explicit script. Once the secret exists, deploy.yml gets its own
step, which the fetcher's docblock now spells out.

Author: zackkatz

package.json

@@ -22,7 +22,7 @@
     "tokens:verify": "node ./scripts/verify-token-interop.mjs",
     "relations:generate": "node ./scripts/generate-relations.mjs",
     "test": "node --test scripts/lib/",
-    "docs:generate": "npm run hooks:generate && npm run api:generate && npm run tokens:generate && npm run relations:generate && npm run hooks:link-api-types && node ./scripts/generate-category-indexes.mjs && npm run merge-tags:generate",
+    "docs:generate": "npm run hooks:generate && npm run api:generate && npm run tokens:generate && npm run relations:generate && npm run hooks:link-api-types && node ./scripts/generate-category-indexes.mjs",
     "llm:enhance": "node ./scripts/enhance-for-llms.mjs && node ./scripts/generate-product-llms.mjs",
     "llm:product": "node ./scripts/generate-product-llms.mjs",
     "docs:full": "npm run repos:clone && npm run docs:generate && npm run llm:enhance && npm run build",

scripts/fetch-merge-tags.mjs

@@ -12,6 +12,20 @@
  * file describing nothing: a page rendering "0 merge tags" looks like a product with no merge tags,
  * not like a broken build, and nobody would go looking for the cause.
  *
+ * NOT chained into `docs:generate`. That script runs in the Pages deploy, and wiring a step
+ * that hard-fails without a secret took the whole site's build down with it (run
+ * 32555981823). It stays an explicit script until MERGE_TAGS_TOKEN exists, at which point
+ * add a step to .github/workflows/deploy.yml:
+ *
+ *   - name: Fetch the merge-tag artifact
+ *     env:
+ *       MERGE_TAGS_TOKEN: ${{ secrets.MERGE_TAGS_TOKEN }}
+ *     run: npm run merge-tags:generate
+ *
+ * Failing loudly is still right for the artifact itself -- an empty catalog would render as
+ * a product with no merge tags. It is not right for it to decide whether every other page
+ * on the site ships.
+ *
  * The source repo is PRIVATE, so this needs a token with read access to it:
  *   MERGE_TAGS_TOKEN   (CI secret; a fine-grained PAT with Contents: read on GravityKit/merge-tags)
  * Falls back to GITHUB_TOKEN / GH_TOKEN for local use.