[core] adopt dev-first release flow

[quan0715]

Summary

• establish dev as the integration line while keeping main production-only
• add a manually dispatched Prepare release workflow that versions dev, creates release/<version>, opens a draft PR to main, and explicitly dispatches CI
• change the main workflow to publish pre-versioned packages only, then open a main → dev synchronization PR
• add release-policy checks for ancestry, consumed Changesets, stable version increases, package-manifest integrity, and version-only release metadata
• add repository contract tests and update the maintained release documentation, including first-release bootstrap instructions

Safety

• this PR targets dev; it does not merge or publish to main
• CI runs with read-only repository contents
• release preparation is retry-safe and rejects unexpected generated/source files
• no package Changeset is included because this PR changes repository release infrastructure only

Validation

• pnpm run typecheck — 5/5 tasks
• pnpm test — repository 27/27; monorepo 5/5 tasks
• pnpm build — 4/4 tasks
• YAML parse and bash -n validation for all workflow shell blocks
• real Changesets simulation: valid 3.1.1 release commit accepted; tampered package manifest rejected
• independent review completed and findings addressed

[cloudflare-workers-and-pages]

Deploying open-press with    Cloudflare Pages

Latest commit:	f804ebe
Status:	✅  Deploy successful!
Preview URL:	https://2d314bac.open-press.pages.dev
Branch Preview URL:	https://codex-dev-release-flow.open-press.pages.dev

View logs