Standing-PR workflows: run every writer on main in one queue, behind an environment-guarded App identity #800

Part of #790 (option 2), together with #785's option C. Blocked by: #766, #798 and #799.

Goal

Every job that writes runs with main as its ref, in one queue, behind an environment that guards the credentials:

• The release jobs. Publish, retry and immediate release start from the push of the release commit to main, or a workflow_dispatch on main, not from pull_request events.
• The update. Label and checkbox events on the open standing PR go through a small relay job that dispatches the update on main. The relay needs only permission to start a workflow, not secrets.
• Release detection. It keys on an untagged release commit, the signal from standing-pr update: bail while a release is untagged, and reconcile from the latest main #799, not on whether the latest commit is the release commit. That way a queued run that a newer push replaces still gets its publish.
• Credentials. An environment restricted to main holds the registry credentials (environment secrets, required by each registry's trusted-publisher settings) and a GitHub App key. That App, not the Actions bot, is the bypass actor for the release-branch lock and the main ruleset.
• Docs. Update ci-setup's securing section: Code Owners review then holds, because no workflow token can bypass the rulesets.

Open design points

• The relay adds a few seconds' delay to label and checkbox updates. Check that this is acceptable.
• Plan the migration for repos already on the pull_request-triggered example.