Deploy docs through AWS OIDC

[alixander]

What changed

• grant the production deploy job GitHub OIDC token permission
• assume the new d2lang-docs-deploy AWS role instead of using static AWS access-key secrets
• point deployment at the new private docs bucket and CloudFront distribution
• retain the Algolia crawler API key as a GitHub secret
• stop requesting the obsolete public-read object ACL

Why

The D2 docs deployment needs to move from Terrastruct-owned AWS credentials and infrastructure to the personally owned D2 AWS stack. The new S3 bucket uses private CloudFront origin access, so object-level public ACLs are neither needed nor accepted.

Impact

After this is merged, successful pushes to master will deploy the docs build to s3://d2lang-docs-278852893615 and invalidate CloudFront distribution E2NLB7I775SAF using short-lived OIDC credentials. This PR does not change production DNS and does not deploy from the PR branch.

Validation

• parsed .github/workflows/ci.yml with Ruby YAML
• ran bash -n ci/deploy.sh
• ran git diff --check
• verified the AWS role trust is restricted to the immutable d2lang/d2-docs repository identity on master
• verified the role policy targets the configured S3 bucket and CloudFront distribution