The site is asked to rebuild on a release, not on every push

[McCal-Codes]

site.yml asked foliolauncher.com to rebuild on every push to main that touched the changelog, roadmap, packages or screen table. The site reads those files at the latest release's tag, not at main, so a push changes nothing until a release is cut. It fired six times on 2 Oct and every rebuild was identical.

What is true now:

• site.yml runs when a release is published, and by hand (Actions, Site, Run workflow). The by-hand run sends the same dispatch a release does, so it tests FOLIO_SITE_TOKEN end to end. The site still rebuilds once a day on its own as a safety net.
• A missing FOLIO_SITE_TOKEN now fails the run instead of printing a notice and passing. The token is fine-grained and expires, and this job now runs only on a release or by hand, so a silent skip would leave the site a day behind a release with nothing to explain it.
• It touches only .github/workflows/site.yml, so it is outside what REL-4b freezes (app/, market/, docs/sdk/source, Gradle).

Checked: the YAML parses, and its triggers are release (published) and workflow_dispatch. The old push trigger worked end to end 6 times this morning (the logs said "Asked foliolauncher.com to rebuild"), so the sender and token are proven; what this PR cannot show is the new run, because a workflow can only be run by hand once it is on main.

Worth knowing: a release published from Actions with the default token would not trigger this (GitHub does not fire workflows from its own token's events). Folio's releases are published by hand, so it does. Also, a release can fire this before its APK and checksums finish uploading; the site's sync now waits for them (folio-site, separate PR).

Not checked: the release trigger itself, which can only be exercised by the next published release.