ci: add the rsync deploy workflow for stratara.tech

[yesbert]

What this changes

• First slice of the approved change serve-the-docs-from-our-own-server (group 2): a new deploy-site.yml that builds the DocFX site exactly as docs.yml does and copies it by rsync to the stratara.tech vhost, behind the production environment gate. Never on a pull request, so a fork's run gets no secrets. --delete with .well-known excluded (design decision 2).
• Post-deploy check asks the live domain: apex answers 200 itself (not a redirect), landing hero present, deep page, imprint, privacy, a badge and llms.txt all 200, no-cache on HTML.
• llms.txt and llms-full.txt are copied to the site root, since the trigger paths name them and DocFX does not ship them.
• Cache headers as .htaccess: only DocFX's fingerprinted assets under public/ are immutable; main.css, main.js and docfx.min.* are unfingerprinted and keep revalidating.
• Records the owner's approval in the proposal and ticks 2.1, 2.3–2.6.

Nothing else moves yet: docs.yml keeps publishing GitHub Pages, no reference changes, no DNS. The workflow does nothing until the production environment, the secrets and the vhost's SSH shell exist (owner tasks 1.1–1.4, 2.2), and its first run is a manual dispatch (2.7).

How it was verified

• Local gauntlet green (./scripts/local-gauntlet.sh)
• docfx build --warningsAsErrors locally; every file the post-deploy check fetches exists in _site; the immutable pattern matches 108 fingerprinted files and none of the 5 unfingerprinted ones

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.