ci(mdbook): drive CI through mise + just (no inline shell)

CI now mirrors the local dev path. The workflow installs mise,
trusts the config, installs all mise-pinned tools (mdbook, just),
and invokes `just build-site` for the whole multi-version build.
There is no longer any build logic inside the workflow YAML.

Changes:

- `mise.toml` now also pins `just = "1.50.0"` so `mise install`
  brings in both mdbook and just.
- `scripts/build-site.sh` (new, POSIX sh, shellcheck-clean) takes
  the multi-version build loop out of the workflow and parks it
  next to the rest of the build tooling. Iterates v* tags via
  `git worktree`, sets `MDBOOK_OUTPUT__HTML__SITE_URL` per
  version, emits `_site/versions.json` and `_site/index.html`
  (root redirect to /latest/).
- `justfile` gains a `build-site` recipe — `sh scripts/build-site.sh`.
- `.github/workflows/mdbook.yml` is now four short steps inside
  the build job: jdx/mise-action (install: false) → `mise trust`
  → `mise install` → `just build-site`. The previous inline
  multi-line bash block is gone.
- `.gitignore` adds `/_site/` alongside the existing `/book/`.

Local smoke test: `just build-site` with no v* tags produces
`_site/{latest/, versions.json=["latest"], index.html}` exactly as
CI will. Future `v0.1.0` tag will add `_site/v0.1.0/` and update
`versions.json` without any code changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

justfile

@@ -15,10 +15,15 @@ _default:
 setup:
     mise install
 
-# Build the spec into ./book/.
+# Build the spec into ./book/ (single-version; for local dev).
 build:
     mdbook build
 
+# Build the full multi-version site into ./_site/ (latest + every v* tag).
+# This is exactly what CI runs.
+build-site:
+    sh scripts/build-site.sh
+
 # Live-preview the spec at http://localhost:3000 with auto-reload.
 serve:
     mdbook serve --open --port 3000