feat: add prepare-command to hugo-ci for generating data before the build

[jmeridth]

What/Why

Add an optional prepare-command to hugo-ci.yaml so a site can generate files (for example in data/) right before Hugo builds, with an optional prepare-secret exposed only to that step as $PREPARE_SECRET.

Proof it works

• actionlint and zizmor report no findings on the changed workflow.
• A caller site builds with a Node script as its prepare step, run locally with the same command the workflow runs.

Risk

Low. Both inputs default to empty, so existing callers skip the new steps and build exactly as before. The prepare step runs before any dependency install, so no third-party package code shares a step with the secret.

AI role

Claude Opus 5.5 wrote the workflow change and docs. The developer reviewed the design and approved opening this PR.

Review focus

• The prepare step runs the caller's command through bash -c from an environment variable rather than a ${{ }} expression in run:.