ci: use token-exchange-service to publish docs

[ccharly]

Note

Medium Risk
Changes how CI authenticates to push gh-pages; misconfigured TOKEN_EXCHANGE_URL or exchange permissions would break doc publishes, though scope is limited to documentation deployment.

Overview
GitHub Pages doc publishing now gets a short-lived contents: write token from MetaMask’s token-exchange flow (get-token + vars.TOKEN_EXCHANGE_URL) instead of wiring PUBLISH_DOCS_TOKEN straight into peaceiris/actions-gh-pages.

Workflow permissions are tightened: callers and the reusable publish-docs job drop default contents: write in favor of contents: read plus id-token: write so OIDC can run; only the token step asks for write access. The reusable workflow no longer documents the per-environment PAT setup for deploy (that comment is removed).

Note: publish-docs.yml still declares PUBLISH_DOCS_TOKEN as a required callable secret and parent workflows still pass it, but deploy no longer consumes it—likely leftover until a follow-up cleanup.

^{Reviewed by Cursor Bugbot for commit 8e04ad7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8b435fa. Configure here.}