fix(ci): serve spec readable by nginx and run demo/bench on PRs

[Arkptz]

Summary

The demo GIF still showed Failed to load API definition / Forbidden ./openapi.yaml after #65. That fix moved openapi.yaml into nginx's web root but kept it a bind-mount, so the file retained the host uid/perms. nginx workers run as the unprivileged nginx user and still could not read it — hence the 403.

This copies the spec into the container instead and chmod 644s it, then fails fast if the spec is not actually fetchable.

Both workflows also now run on pull_request when their own inputs change, so CI changes are verifiable before merging to main rather than after.

Type of Change

• Bug fix (non-breaking)
• CI / build / tooling

Checklist

• cargo fmt --all clean (no Rust changes)
• cargo clippy --all-targets --all-features -- -D warnings clean (no Rust changes)
• cargo test passes locally (no Rust changes)
• Added or updated tests for the change
• Updated README / CLI help text if user-facing behavior changed
• Added entry to CHANGELOG.md under [Unreleased] (if user-facing)
• Used conventional commit style in commit messages (feat:, fix:, docs:, etc.)

Testing

Reproduced the root cause locally and verified the fix:

1. Confirmed the cause — nginx runs workers as nginx, not root:

   $ docker run --rm -v $PWD/perm600.yaml:/usr/share/nginx/html/openapi.yaml:ro \
       --entrypoint sh swaggerapi/swagger-ui \
       -c 'su -s /bin/sh nginx -c "cat /usr/share/nginx/html/openapi.yaml"'
   cat: can't open '/usr/share/nginx/html/openapi.yaml': Permission denied
   

2. Verified the fix with a deliberately 0600 spec (the CI failure condition) — docker cp + chmod makes it readable and it serves HTTP 200.

3. Ran the real phase3.spec.ts against a 0600 spec: passes, and the recorded video's final frame shows the spec rendered (Test API 1.0.0 OAS 3.0) with no error banner and zero browser console errors.

Workflow changes

• pull_request trigger on both workflows, path-filtered to their own inputs
• checkout uses github.head_ref || github.ref_name (PR checkouts are otherwise detached HEAD)
• Artifacts push to the originating branch, not main
• Pushes skipped for fork PRs, whose tokens are read-only

Related Issues

Follow-up to #65