Promote Pages production after stable releases

[AnthonyRonning]

What this does

• Adds an independent workflow that advances the machine-owned pages-production branch to the exact commit of the latest successful stable Maple release.
• Keeps Pages promotion outside the core release dependency chain, so a Pages failure cannot block the release or updater metadata publication.
• Uses only the scoped GitHub token (contents: write); no Cloudflare credential is added.
• Rejects stale runs, prereleases, tag/SHA mismatches, rollbacks, divergence, and race changes before updating the ref.
• Updates release-gate tests, actionlint coverage, and the release runbook.

Cloudflare remains unchanged by this PR. After it merges, we can point the existing Pages project production branch from master to pages-production.

Validation

• nix develop --no-update-lock-file .#ci -c bash ./scripts/ci/test-release-gates.sh — 23/23 passed
• nix develop --no-update-lock-file .#ci -c actionlint .github/workflows/pages-production.yml .github/workflows/release-gates-tests.yml
• nix flake check --no-update-lock-file --print-build-logs
• Exercised the promotion script against live repository state using v3.3.8; it rejected the intentional rollback case before mutation and left pages-production unchanged at 8b175196f9c0fa5959c32ba08404a7026faf5347.