v0.13.1: @newsroom.writer: majors go to main

The release workflow (.github/workflows/deploy-pages.yml) now has a discipline for majors.

• dev carries every release. Minors as before (v0.13.1, v0.13.2, ...). The version is always set on dev in admin/build/version.txt, because the built pages carry it.
• A major is a release commit on dev that bumps to the next .0, such as v0.14.0. Then dev goes to main by pull request.
• major-gate: a pull request into main fails unless version.txt is a .0 major with its release note in admin/engineering/releases/.
• major-release: on a push to main, the version must be a .0 major. Its tag is made if dev's run did not make it, and a GitHub Release is published with the release note as its notes. main deploys only after that succeeds.
• Pull requests no longer cancel releases. Pull-request runs have their own concurrency group, and pushes queue instead of cancelling one another. The v0.13.0 run on dev had been cancelled by its own pull request's checks, which left v0.13.0 untagged; this run's backfill tags it.