chore(docs): pipeline updates and Protected Areas guideline

[mckeea]

Pre-release review — partial batch

review/2026-09-20 -> test. A branch cut from test carrying only the content
selected for this release, rather than all of develop.

What's in

Pipeline, CI and config — 20 files

Build-time media compression (compress_media.py + its build-docs.sh step),
which re-encodes document images as JPEG in the render tree only, so DOCS/
keeps the lossless originals. This is what brings the Protected Areas PDF from
550 MB to 68.9 MB, under GitHub's 100 MB per-file limit.

Also: grid-table realignment, the dangling-link Lua filter, the builder image
bumped to quarto-doc-builder:1.0.5 (adds ImageMagick), ruff.toml, and
validate-pull-request.yml extended to accept a review/* head into test.

Protected Areas guideline (#79) — 756 files

DOCS/Protected_Areas/PA21_Description_MappingFeatures_Guideline_v3.qmd plus
377 media files, its .llm_cache entry and 377 image-description cache entries.
The image cache is required, not incidental: inject_image_descriptions.py keys
alt text on image md5, so without it the document renders with no alt text.

One frontmatter fix — 1 file

DOCS/High_Resolution_Layer/Small_Landscape_Features_2021_PUM_v1.qmd — test
carries date: "16/09/2025", which fails the schema check. develop already has
date: 2025-09-16. Included because validate-qmd.yml validates the whole tree
on every PR into test, so without it this PR cannot pass its own checks.

What's held back on develop

7 documents and their media (231 files): the clcplus-core and filenaming
renames, the CDSE Migration dashboard, the editor manual, and the parsEO
dashboard. They stay on develop and can go in a later batch.

Verification

Full build-docs.sh run locally against this content: 36 PDFs, none over
100 MB, 1886 image references with none dangling, image alt text preserved.
The same pipeline has since deployed cleanly to the develop environment.

---

• Review the diff below.
• Approving auto-merges: auto-merge.yml squashes on approval once checks pass.
• After merge, docs build and deploy to the test environment.

Title keeps a non-bump conventional-commit prefix (chore); the release bump is
decided at the test -> main step.