maintenance: reduce release overhead and close Scorecard gaps

[jeremi]

Summary

This replaces the stale stacked implementation with the minimum release and Scorecard improvements justified by current evidence.

• patches the fixable docs-site dependency advisories; npm audit now reports zero vulnerabilities
• pins the three GitHub Pages actions to reviewed commit SHAs
• staggers routine Dependabot updates and limits each ecosystem to one open version-update PR
• makes GitHub Release publication publish-once: an existing release, API failure, or ambiguous lookup stops before builds and image publication; failures fix forward to a new patch version

Deliberate scope limits

• no finalization classifier: the added policy surface was disproportionate and current path routing already avoids unnecessary product matrices
• no docs archive cache: the larger cache design is not justified without a recurring measured bottleneck
• no bespoke release-evidence bundle: the current signed-release control already scores 10/10 and the workflow already reconciles published assets
• no Scorecard-only advisory suppressions, no weakening of the SLSA workflow reference, and no cosmetic approval requirement without a genuine second human reviewer

Verification

• 63 release-script tests passed
• 80-gate workflow inventory passed
• release and Pages workflows passed actionlint
• Dependabot configuration parsed and all six schedules, time zones, and PR limits were checked
• clean install and both full and production npm audit report zero vulnerabilities
• 117 docs tests and the complete existing docs check passed in the focused dependency worktree
• the combined branch rebuilt the current site and historical archives through the dependency-sensitive sweep before the duplicate local sweep was stopped; generated state was restored and is clean
• independent review found no remaining actionable issues
• all four commits carry DCO sign-off

Part of #427.

[jeremi]

Release review verdict: please do not merge this stack as-is.

Required before reconsideration:

• Rebase onto current main after the release reproducibility fix is settled, preserving the canonical release binary and image wrappers and their pinned builder checks.
• Keep current main planner validation, including exact modern artifact-inventory enforcement. The current branch can report ready for an invalid incomplete inventory.
• Update the OCI label inspection path so it handles the actual pushed multi-manifest image shape, and make the smoke test exercise that same shape.
• Run the full protected-branch checks on the rebased head.

This is valuable finalization hardening, but it is not a confirmed beta-16 blocker and should not delay the fix-forward release.

[jeremi]

Fresh beta-16 review at head 7a8a4697acb606931239bb503be6b05685edc0e2: please keep this draft out of the current release train and rebase it after #443 lands.

Required before reconsideration:

• preserve the reproducible build wrappers and workflow changes from fix(release): make release builds reproducible #440 plus the dependency-security changes from security: retire stale dependency exceptions #434
• resolve the current conflicts across the release workflow, release planner, OCI label checker/smoke, gate inventory, and tests
• retain current-main planner validation for a resolvable source ref, exact modern artifact inventory, and the registryctl Cargo.lock version
• fix the OCI smoke/checker mismatch so oci-layout:// inputs are actually supported
• rerun the full protected-branch check set on the rebased result

The controls are valuable, but the current head would regress beta-16 release invariants if merged as-is.