ci(docs): publish the documentation site from a release tag

The documentation site deployed on every master push, with no reviewer and
no version check, while npm, PyPI, and the public source repository all
advance only at a release tag. The Pages site is reachable without
authentication, so a merge published documentation ahead of every artifact
readers could obtain.

docs-pages.yml now declares workflow_dispatch alone and verifies the ref
through the gate npm publication already runs, so the site and the npm
sequence share one definition of a released version.

.github/workflows/docs-pages.yml

@@ -1,17 +1,16 @@
+# Publish the documentation website to GitHub Pages. This workflow is manual-only
+# (workflow_dispatch) and intentionally does not listen to pull_request or push:
+# the site presents a released snapshot, so publication is an explicit act from a
+# dsh-v* tag and must never appear as a PR check. `release:verify` rejects every
+# other ref, and the github-pages environment repeats that restriction as a
+# deployment tag policy with required reviewers.
+#
+# The build signal does not depend on this workflow. Every pull request builds
+# the production site through `check:ci:static`, and ci-master.yml builds it
+# again on master.
 name: Deploy documentation
 
 on:
-  push:
-    branches: [master]
-    paths:
-      - '.github/workflows/docs-pages.yml'
-      - 'docs/**'
-      - 'package.json'
-      - 'pnpm-lock.yaml'
-      - 'pnpm-workspace.yaml'
-      - 'scripts/project-doc-site.ts'
-      - 'scripts/project-doc-site.spec.ts'
-      - 'website/**'
   workflow_dispatch:
 
 concurrency:
@@ -24,7 +23,11 @@ permissions:
 env:
   PRIMARY_NODE_VERSION: '24'
   # Projected source links target the public repository, whose history can
-  # differ from this workflow's source repository.
+  # differ from this workflow's source repository. This stays on master rather
+  # than following the dispatched tag: that repository advances only to each
+  # release commit, so its master never carries unreleased work, and it retains
+  # only the most recent tags — following the tag would leave every projected
+  # source link on an older deploy unresolvable.
   DOCS_REPOSITORY_REF: master
   # CI runs must never report to the production telemetry endpoint baked
   # into apps/cli/cordis.yml (AppCLIEntry disables the row when set).
@@ -37,7 +40,11 @@ jobs:
       contents: read
       pages: read
     steps:
+      # Complete history: the release scripts read tags.
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - uses: pnpm/action-setup@v4
 
@@ -49,6 +56,14 @@ jobs:
       - name: Install (immutable)
         run: pnpm install --frozen-lockfile
 
+      # One definition of "released" for the site and the npm sequence: this
+      # rejects every ref that is not a dsh-v* tag naming the version this tree
+      # carries.
+      - name: Verify release version
+        env:
+          RELEASE_PUBLISH: 'true'
+        run: pnpm run release:verify --family dsh
+
       - name: Configure Pages
         id: pages
         uses: actions/configure-pages@v6