Add workflow to publish docs on release

[janbrasna]

Description

Pushes the tag/sha used for creating a Release to prod branch for Netlify to pick it up, building and publishing the production site.

• I have documented this change in the design system.
• I have recorded this change in CHANGELOG.md.

Testing

This aims to do no lint/tests, as that all should have been sorted out merging into main, and when the Release author selects the commit~ish for releasing/tagging, they ought to have verified everything a-ok in staging and pipeline already.

If a changeset failing to build is pushed, nothing really happens as Netlify deployment will just fail the build but still keep the previous stable deployment available so until addressed, the previous version will be served.

Pushes are ff-only otherwise rejected so are foolproof, no destructive operation can happen.

Failures as releasing older versions than already published etc. are not skipped silently, but visibly fail the run to show it didn't get published, and for what reason (diverging histories, pushing older ref, nothing in common etc.) keeping it as low level as possible. [ex]

This intentionally doesn't add a manual workflow_trigger to only really enforce tagged release sha refs not allowing arbitrary refs being pushed to prod. If a manual correction is needed, this won't interfere with any git operations undertaken, just trying to push the next released tag to the linear history of prod again. [ex]

Repository activity correctly shows when a bot updates a branch, so it can be easily distinguished if the prod push was manual or automated. [ex]