ci(docs): redeploy when the lock changes, and allow manual dispatch

[CameronBrooks11]

The gap

The docs site is built with uv sync --group docs, so what it ships is decided by uv.lock — but uv.lock and pyproject.toml were not trigger paths. A dependency fix could land on main while the deployed site kept serving the previous build, and there was no workflow_dispatch, so it could not be rebuilt by hand either.

Not hypothetical

mkdocs-material 9.7.6 — GHSA-xvg9-69gf-fjrf / CVE-2026-73295, DOM XSS in search suggestions, patched in 9.7.7 — was live on the published docs:

$ curl -s https://heibench.github.io/gerberdiff/ | grep generator
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.6">

The advisory is scoped development, which understates it here: the vulnerable code is in the search bundle that the public site serves.

Merging #16 alone would have closed the Dependabot alert and left that build served — a green signal that did not match what was deployed.

After #16, a fresh strict build from the updated lock

$ uv sync --group docs && uv run mkdocs build --strict
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.7">

The change

Adds uv.lock and pyproject.toml to both trigger lists, and adds workflow_dispatch. Because .github/workflows/docs.yml is itself a trigger path, merging this redeploys the site, which is what actually gets 9.7.7 in front of readers.

orlab's docs workflow already has the right shape — no path filter plus workflow_dispatch — so this brings gerberdiff in line with the sibling rather than inventing a convention.