bug(mkdocs-deploy): deploy-token / ACTIONS_DEPLOY_TOKEN is never used — the push relies on checkout credentials

[MAfarrag]

Context

actions/mkdocs-deploy declares a required deploy-token input and maps it to an ACTIONS_DEPLOY_TOKEN
environment variable in all three deploy steps (pull_request / main / release). Consumers wire it from
${{ secrets.GITHUB_TOKEN }} (or a PAT) expecting it to authenticate the git push that mike deploy --push
performs against gh-pages.

Problem / Current Behaviour

ACTIONS_DEPLOY_TOKEN is never consumed. There is no git remote set-url, no http.<host>.extraheader,
and no reference to the variable in any mike/git command. mike's git push authenticates with whatever
credentials the caller's actions/checkout left behind (by default persist-credentials: true, which installs
the GITHUB_TOKEN extraheader). Consequences:

• Passing a dedicated PAT via deploy-token does nothing — it is silently ignored.
• The deploy's real auth dependency (the checkout token, which must have contents: write) is undocumented.
• A caller who sets persist-credentials: false on checkout, or checks out with a token lacking contents: write,
  gets a 403/could not read Username failure on push even though deploy-token is correctly set — a
  confusing, hard-to-debug failure.

Affected locations

File	Symbol	Notes
actions/mkdocs-deploy/action.yml	inputs.deploy-token (lines 51-56)	required: true, described as "GitHub token for deployment"
actions/mkdocs-deploy/action.yml	deploy step env (lines 216, 227, 240)	ACTIONS_DEPLOY_TOKEN: ${{ inputs.deploy-token }} set, never read

Steps to Reproduce

1. Use mkdocs-deploy with actions/checkout configured `persist-credentials: false`,
   and pass deploy-token: ${{ secrets.GITHUB_TOKEN }}.
2. The deploy step fails at `git push` with a 403 / auth error, despite deploy-token being set.
   (Equivalently: pass a bogus deploy-token but keep the default checkout credentials -> the deploy
   still succeeds, proving the input is ignored.)

Proposed Solution

Pick one and make the input honest:

• (A) Wire it (recommended, non-breaking). In the deploy steps, use ACTIONS_DEPLOY_TOKEN to authenticate the
  push — e.g. git remote set-url origin https://x-access-token:${ACTIONS_DEPLOY_TOKEN}@github.com/${{ github.repository }}.git
  or an http.extraheader config — so the input actually controls auth. Keeps the documented intent and lets
  consumers use a scoped deploy token independent of the checkout token.
• (B) Drop it (breaking). Remove the deploy-token input and ACTIONS_DEPLOY_TOKEN env, and document that the
  deploy uses the caller's actions/checkout credentials (persist-credentials: true, token with
  contents: write). Simpler, but a breaking change to the input contract → major version bump.

Out of Scope

• The mike deploy --push fetch-reset-retry work (bug(mkdocs-deploy): mike deploy --push has no rebase/retry, so a concurrent gh-pages push fails the deploy #13).
• Notebook execution / caching.

Effort Estimate

Size: S — option A is a few lines of git-auth wiring across the three deploy steps plus a config assertion;
option B is an input removal + major bump + migration note.

Definition of Done

• deploy-token either authenticates the gh-pages push (option A) or is removed with the
  checkout-credential dependency documented (option B) — no silently-ignored required input remains.
• Input description and docs updated to match (see the companion docs issue).
• Caveat noted: the test harness uses a file:// fake remote that needs no auth, so a true end-to-end auth
  test isn't possible there; assert the git auth config is set from the token instead.