ci: automate releases and deploy the Cloudflare demo

[nick-csu]

Summary

• enforce the feature -> pre-release -> main promotion path in CI and Dependabot
• run audit, format, lint, build, coverage, package, browser, SDK, and publishing tests
• deploy a Worker-native demo API and OpenNext docs UI to the demo domains after main succeeds
• generate the three-section changelog with Copilot CLI, bump the patch version, tag, and publish the public npm packages
• document local Worker development and the contributor release flow

Local verification

• npm audit --audit-level=high
• npm run format:check
• npm run lint
• npm run build
• npm run test:coverage
• npm run pack:check
• Cloudflare Worker bundle dry-runs
• Playwright MCP checks for the Worker preview, theme toggle, REST, and GraphQL