Add Writer CI and protected manual Pages deployments

[callumalpass]

Writer had no CI: PRs merged on local checks, and production deployed from a laptop (pnpm deploy:prod).

• CI on pull requests and pushes to main: install, pnpm check (typecheck, tests, manifest), production and staging builds, and the Chromium suites (browser-test.mjs and browser-reliability-test.mjs against the ?demo collection).
• Deploy workflow: workflow_dispatch with a staging or production target, modelled on Reader's deploy-reader.yml. It reuses scripts/deploy-pages.mjs, runs from main only and is environment-protected.

Settings needed before the deploy workflow works (detailed in docs/development.md):

• Environments writer-staging and writer-production, restricted to main, with required reviewers on production.
• CLOUDFLARE_API_TOKEN (Cloudflare Pages: Edit) and CLOUDFLARE_ACCOUNT_ID in both environments.
• Make Writer's CI check required on main.

Validation: actionlint passes. Locally: checks, both builds and all 20 reliability scenarios pass. One adoption scenario flaked once and passed on rerun; no assertions were weakened.