feat(ci): re-run the skill check on main and build the docs on PRs (4/4)

[miscreantmoogly]

Stacked PR 4 of 4. Based on #128; review and merge in order. This diff shows only this PR's changes.

Description

• validate-skills-main.yml re-runs the check after every push to main, against the commit main pointed at before the push. Two PRs that each passed on an older base can break the rules together, for example by bumping one skill to the same version. This reports it at once.
• build-docs.yml runs mkdocs build --strict on every PR, with the same mkdocs-material pin as deploy-docs.yml. Today a broken Pages build is found only after merge (fix(docs): unbreak the strict docs build on main #122). It builds only; it deploys nothing and doesn't change Pages.
• .github/CODEOWNERS makes @aws/tools-for-devops-agent-admins the owner of /.github/. A PR runs its own copy of every check, so without this it could edit a check, or its rule data, to pass.

Type of change

• Documentation or infrastructure change

Testing

• mkdocs build --strict passes locally with mkdocs-material==9.6.14.
• The workflow YAML parses.
• The post-merge base fallback (an all-zero before, or a missing one after a force push) can only be exercised after merge.

Requests for maintainers (after the stack merges)

1. Add validate-skills, build-docs and the existing scan-aws-identifiers to the required status checks for main.
2. Turn on "Require review from Code Owners", so CODEOWNERS takes effect.
3. Turn on "Require branches to be up to date before merging", or a merge queue.
4. Turn on secret scanning with push protection, and dismissal of stale approvals.

[ams-thakkar]

Holding this one, and #125 likewise: @aadimch and @miscreantmoogly have each built the same check independently, and the two are not compatible as they stand — most pointedly, metadata.deprecated is specified oppositely (quoted "true" here, unquoted true in #125), and each documents its own form in CONTRIBUTING.md.

I have asked the two of you to agree on which set to keep.