docs(ci): Add docs deployment workflow

why: Deploy Sphinx docs to S3/CloudFront on push to main.
what:
- Add docs.yml workflow matching libtmux's pattern
- Uses OIDC for AWS auth, paths-filter for change detection
- Triggers on main branch (not master)
- Secret names: LIBTMUX_MCP_DOCS_ROLE_ARN, LIBTMUX_MCP_DOCS_BUCKET,
  LIBTMUX_MCP_DOCS_DISTRIBUTION

Author: tony

.github/workflows/docs.yml

@@ -0,0 +1,104 @@
+name: docs
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    environment: docs
+    strategy:
+      matrix:
+        python-version: ['3.14']
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Filter changed file paths to outputs
+        uses: dorny/paths-filter@v3.0.2
+        id: changes
+        with:
+          filters: |
+            root_docs:
+              - CHANGES
+              - README.*
+            docs:
+              - 'docs/**'
+            python_files:
+              - 'src/libtmux_mcp/**'
+              - uv.lock
+              - pyproject.toml
+
+      - name: Should publish
+        if: steps.changes.outputs.docs == 'true' || steps.changes.outputs.root_docs == 'true' || steps.changes.outputs.python_files == 'true'
+        run: echo "PUBLISH=$(echo true)" >> $GITHUB_ENV
+
+      - name: Install uv
+        if: env.PUBLISH == 'true'
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Set up Python ${{ matrix.python-version }}
+        if: env.PUBLISH == 'true'
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install dependencies [w/ docs]
+        if: env.PUBLISH == 'true'
+        run: uv sync --all-extras --dev
+
+      - name: Install just
+        if: env.PUBLISH == 'true'
+        uses: extractions/setup-just@v3
+
+      - name: Print python versions
+        if: env.PUBLISH == 'true'
+        run: |
+          python -V
+          uv run python -V
+
+      - name: Cache sphinx fonts
+        if: env.PUBLISH == 'true'
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/sphinx-fonts
+          key: sphinx-fonts-${{ hashFiles('docs/conf.py') }}
+          restore-keys: |
+            sphinx-fonts-
+
+      - name: Build documentation
+        if: env.PUBLISH == 'true'
+        run: |
+          cd docs && just html
+
+      - name: Configure AWS Credentials
+        if: env.PUBLISH == 'true'
+        uses: aws-actions/configure-aws-credentials@v5
+        with:
+          role-to-assume: ${{ secrets.LIBTMUX_MCP_DOCS_ROLE_ARN }}
+          aws-region: us-east-1
+
+      - name: Push documentation to S3
+        if: env.PUBLISH == 'true'
+        run: |
+          aws s3 sync docs/_build/html "s3://${{ secrets.LIBTMUX_MCP_DOCS_BUCKET }}" \
+            --delete --follow-symlinks
+
+      - name: Invalidate CloudFront
+        if: env.PUBLISH == 'true'
+        run: |
+          aws cloudfront create-invalidation \
+            --distribution-id "${{ secrets.LIBTMUX_MCP_DOCS_DISTRIBUTION }}" \
+            --paths "/index.html" "/objects.inv" "/searchindex.js"
+
+      - name: Purge cache on Cloudflare
+        if: env.PUBLISH == 'true'
+        uses: jakejarvis/cloudflare-purge-action@v0.3.0
+        env:
+          CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
+          CLOUDFLARE_ZONE: ${{ secrets.CLOUDFLARE_ZONE }}