ci: add external link check (lychee, hybrid non-blocking) (#339)

* ci: add external link check (lychee, scheduled + on-demand)

Adds a non-blocking external-link checker mirroring wickra-docs: an
authoritative weekly + on-demand lychee run (this workflow), kept off the
PR/release path so a flaky third-party site can never block a merge or an
irreversible publish. Fixes the one redirecting link it would flag
(docs.rs/wickra -> docs.rs/wickra/latest/wickra/ in SUPPORT.md).

* ci: run lychee as a non-blocking PR job (continue-on-error)

Hybrid link-check: the authoritative run is the scheduled links.yml; this
adds an early heads-up on PRs that never gates the merge. release.yml stays
ungated so a flaky third-party site can never block an irreversible publish.

lychee.toml

@@ -0,0 +1,23 @@
+# lychee external-link checker config (see .github/workflows/links.yml).
+# Only http(s) URLs are checked; relative/internal links are skipped via the
+# scheme filter and --root-dir resolution. Loopback and private addresses are
+# skipped too.
+
+max_retries = 3
+retry_wait_time = 2
+timeout = 20
+
+# Treat these as success: OK, partial content, and rate-limited (transient).
+accept = [200, 206, 429]
+
+scheme = ["https", "http"]
+exclude_all_private = true
+
+# Known false positives (the URLs are valid; lychee just can't verify them as a
+# non-browser client):
+# - crates.io and npmjs.com return 403/404 to non-browser requests
+#   (anti-scraping); the package pages are live in a browser.
+exclude = [
+  'crates\.io/crates/',
+  'www\.npmjs\.com/package/',
+]