Refactor site generation for deterministic async execution, safer HTML rendering, and CI workflow separation

[Copilot]

This PR implements the planned hardening pass across generator runtime, rendering safety, and delivery workflows. It removes nondeterministic async behavior, improves accessibility and content handling in generated pages, and introduces test coverage for the generator core.

• Generation flow reliability

  • Converted generation entrypoint to async (Program.Main now awaits generation).
  • Replaced async void generation/index methods with awaitable Task methods.
  • Switched file output writes to async APIs and made generation ordering explicit.

• State and API cleanup

  • Removed mutable global generation state from Nocco.
  • Introduced explicit generation inputs (GenerateAsync(examplesRoot, siteFolder)), making behavior deterministic and easier to test.
  • Made SITE_FOLDER immutable (const).

• Rendered HTML safety

  • Added HtmlSafety sanitizer and applied it to transformed markdown before MarkupString rendering.
  • Strips dangerous elements/attributes (e.g., script-like tags, inline event handlers, javascript: URLs) from docs HTML.

• Template UX/accessibility improvements

  • Fixed tab selection logic so only one tab is checked by default.
  • Added tab/panel semantics (role="tablist", role="tab", role="tabpanel") and explicit associations.
  • Improved copy-button accessibility with aria-label.
  • Replaced brittle empty-string checks with string.IsNullOrWhiteSpace(...).
  • Fixed CSS typo (ouline → outline) and preserved focus visibility.

• Automated tests

  • Added new test project (dotnetbyexample.Tests) and solution wiring.
  • Added tests for:
    • parse section splitting
    • language mapping
    • figure attachment resolution
    • end-to-end generation smoke path

• CI workflow split

  • Converted existing build workflow to validation-only (no deploy side effects on PR validation path).
  • Added dedicated deploy workflow for trusted branch pushes/manual dispatch.
  • Added explicit workflow token permissions in deploy workflow.

• Content consistency pass

  • Updated selected figure captions to .NET/C#-accurate terminology where wording was inherited from Go-centric concepts.

// before
private static async void GenerateIndex() { ... }

// after
private static async Task GenerateIndex(
    Dictionary<string, List<string>> examples,
    string siteFolder) { ... }

// entrypoint
static async Task Main(string[] args)
{
    await Nocco.GenerateAsync();
}