ci: add build-docs workflow

[jimisola]

Summary

• Add caller workflow for centralized Antora docs build validation
• Runs on PRs and pushes to main when docs/** files change
• Calls reusable workflow from reqstool/.github

Test plan

• Verify Build Docs workflow passes after merge

In general, the fix is to add an explicit permissions block to the workflow (either at the top level, applying to all jobs, or inside the specific job) that grants only the minimal scopes required by the workflow. Because this workflow only delegates work to a reusable workflow, and we do not see any need for write access here, the safest minimal starting point is to set contents: read at the workflow level. This both documents the intent and ensures the GITHUB_TOKEN is not accidentally granted broader privileges via defaults.

Concretely, in .github/workflows/build-docs.yml, add a permissions block between the name: and on: keys. For a minimal, read-only token suitable for typical documentation build workflows that only need to check out code or download artifacts, use:

permissions:
  contents: read

This will apply to all jobs (including the build job that uses the reusable workflow) unless they override permissions themselves. No additional imports, methods, or definitions are required; this is purely a YAML configuration change.