ci: add external link check (lychee, hybrid non-blocking) (#339)

* ci: add external link check (lychee, scheduled + on-demand)

Adds a non-blocking external-link checker mirroring wickra-docs: an
authoritative weekly + on-demand lychee run (this workflow), kept off the
PR/release path so a flaky third-party site can never block a merge or an
irreversible publish. Fixes the one redirecting link it would flag
(docs.rs/wickra -> docs.rs/wickra/latest/wickra/ in SUPPORT.md).

* ci: run lychee as a non-blocking PR job (continue-on-error)

Hybrid link-check: the authoritative run is the scheduled links.yml; this
adds an early heads-up on PRs that never gates the merge. release.yml stays
ungated so a flaky third-party site can never block an irreversible publish.

.github/workflows/ci.yml

@@ -1146,3 +1146,22 @@ jobs:
   # (.github/workflows/bench.yml) — see audit finding R10. It runs nightly
   # at 03:00 UTC and on-demand via `workflow_dispatch`, and is no longer on
   # the every-push / every-PR critical path.
+
+  # Non-blocking external-link heads-up on PRs. The authoritative check is the
+  # scheduled links.yml; here it only surfaces link rot early without ever
+  # gating a PR — external sites flake (rate limits, transient outages, moves),
+  # so `continue-on-error` keeps a third-party hiccup from blocking the merge.
+  # Redirects are reported as warnings (lychee only fails on hard errors).
+  links:
+    name: External links (non-blocking)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
+        with:
+          args: --config lychee.toml --no-progress --root-dir "${{ github.workspace }}" "*.md" "bindings/*/README.md"
+          fail: true