ci: generate documentation PDFs on schedule or manual dispatch

[dengliming]

Summary

PDF generation currently runs for every PR and push to main, installing TeX Live, Sphinx, Pandoc, and fonts before building the website. Move it to a dedicated weekly/manual workflow so routine website builds do not depend on PDF generation.

 Website Deploy
+  workflow_dispatch (build only)
   pull_request / push to main
-    setup Python and generate PDFs
     build website
     deploy on push to main
+Documentation PDFs
+  schedule: Mondays at 02:17 UTC / workflow_dispatch
+    generate and upload English and Chinese PDFs
+    publish to asf-site/pdf from upstream main only

Serialize website and PDF publishing with a shared concurrency group. Scheduled PDF builds are disabled on forks; manual builds remain available for testing.

Closes #1152.

Evidence

• Before: deploy.yml unconditionally ran generate-pdf.sh on PRs and main-branch pushes.
  After: YAML assertions confirm PDF generation has only schedule and workflow_dispatch triggers, and the website workflow contains no PDF setup/generation steps.
• Validation: git diff --check, YAML parsing, deployment guard/concurrency/destination assertions, and Bash syntax checks passed. Full PDF generation and publishing require a GitHub Actions runner and were not executed locally.

Merge Danger

Door: two-way — revert the workflow changes to restore the previous behavior.

Blast Radius: CI

Ordinary website deployments use the repository's PDF copies and may replace newer published PDFs until the next scheduled or manual PDF run. Manual Website Deploy runs build the site; publishing remains restricted to pushes to main.