Add CI, release, and Pages workflows with Dependabot

- ci.yml: typecheck, tests, and pack check on Ubuntu (Node 22, 24, 26), macOS and Windows (Node 24)
- release.yml: tag vX.Y.Z reruns CI, checks tag, package.json and CHANGELOG agree, publishes with npm trusted publishing, and creates the GitHub Release
- pages.yml: deploys site/ to GitHub Pages
- Jobs run on GitHub only; the Gitea origin's runner skips them
- Dependabot proposes grouped npm and Actions updates weekly

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test (${{ matrix.os }}, Node ${{ matrix.node }})
+    # GitHub only: the Gitea origin also runs .github/workflows but has no macOS/Windows runners.
+    if: github.server_url == 'https://github.com'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        node: [22, 24, 26]
+        include:
+          - os: macos-latest
+            node: 24
+          - os: windows-latest
+            node: 24
+    env:
+      HUSKY: "0"
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm test
+      - name: Check package contents
+        run: npm pack --dry-run