Only update the documentation on a `push`.  We were previously updating the documentation only when not in a `pull_request`, which meant that we would push documentation updates in manual build triggers.

open: input validation for empty segments in path

All the other workflows jobs check out into the `source` directory; do this in the documentation build job as well, for consistency across jobs.

Omitting an entrypoint.sh to configure the container and instead
depending on docker primitives allows us to be more portable.  (If a
distribution uses a different mechanism for adding users, we need not
have multiple entrypoint.sh files or invariants within it; instead we
can configure that in the dockerfile itself along with all the other
distribution specific components.)