chore: expand and harden release workflow

[tinfoilcipher]

Changes:

• Build and Deploy workflow. Sets actions to latest available and fixes packages to hashes instead of semvers
• Removes comments and cruft from autogenerated workflow

Adds:

• Separate build only workflow for opening/syncing PRs, ensure the to-be-deployed site is sane