Deploy the website from its own release line

[okcodes]

Wires the landing page up for GitHub Pages, following the shape already proven
in the sibling repository: a second vump project, a website-v* tag line, and a
deploy workflow gated on vump check.

Two release lines

vump.toml now declares two projects, told apart by the shape of their tag.

Project	Tracks	Tagged	Ships
main	Cargo.toml, Cargo.lock	v1.2.3	the binary, via release.yml
website	website/package.json	website-v1.2.3	website/ to Pages, via release-website.yml

vump check infers the project from the tag, so neither workflow names
--project. The shapes cannot collide — a website tag does not start with v —
and release.yml's glob is anchored to a digit while we are here, so v* no
longer matches voldemort.

Shipping a site-only change is vump patch --project website --through push. No
vump version, nothing said to anyone pinning the binary.

website/package.json gets its version back. It was dropped when the site had
no release line, on the grounds that a number nobody maintains is a lie — vump
now keeps it in step with the tag, which is what makes it true.

The version the page states

Read at build time from website/src/content/release.json. The masthead used to
fetch it from the GitHub API on every page load: unauthenticated that is sixty
requests an hour per address, so the version would vanish for anyone behind a
busy NAT, and the page would say different things to different people.

Reading Cargo.toml instead is the obvious move and is wrong. Cargo.toml
holds the version most recently bumped, not the version most recently
published — right now it says 0.8.0-alpha.0 for a tag that was never pushed,
while the newest release is 0.7.0. The page would advertise a download with no
binaries behind it, which is this tool's own defect pointed at itself.

pnpm bump:vump picks the newest stable tag from the repository itself, so
moving the site to a new release is one offline command, not a lookup that can
be rate-limited. Pre-releases are skipped: the download button hands over the
newest stable, and stating an alpha beside it would be two answers to one
question.

Prerendering

dist/index.html now ships with the page rendered into it. A second Vite pass
builds src/entry-server.tsx, scripts/prerender.mjs inlines the result into
#root and deletes the intermediate, and main.tsx hydrates when #root
already has children.

Three things had to stop depending on the browser, none of them workarounds:
the theme now lives on the document element instead of React state (the
pre-paint script is what prevents the flash, and mirroring it into state would
have given the server HTML a theme it cannot know); the theme toggle renders
both icons and hides one in CSS, so hydration cannot swap it under the visitor;
and the entrance animations are gated on a js class, without which a
scripting-disabled client would get the prerendered markup at opacity zero —
there, and invisible.

Version badge

Fixed to the corner, not in the footer: a bug report is a screenshot, and this
needs to be in every one without the reporter scrolling first. It shows the
site's version — read from the file vump keeps in step with the tag, so it
cannot drift — and the commit the deploy was built from.

Workflows

release-website.yml builds and deploys on a website-v* tag. It uses the
composite check action rather than the build in the checkout, which is the
opposite of release.yml and deliberate: what is verified here is the website's
version, not the binary about to be published, so there is no regression an
older vump could miss — and building one would drag a Rust toolchain into a job
that ships static files.

website.yml runs typecheck, lint, format and build on pull requests touching
the site. Separate workflow with a path filter rather than a job in test.yml,
which has none and would run the Rust suite for a copy edit.

Installing is pnpm install --frozen-lockfile in both: the committed lockfile
is the declared input, so a rebuild of the same commit produces the same bytes.

Every uses: in the repository was checked against its published releases
rather than assumed. actions/checkout was a major behind and moves to v7
across all four workflows; everything else was already current.
dtolnay/rust-toolchain stays on stable, which is the moving reference that
action documents rather than a pin left behind.

release-website.yml has no workflow_dispatch. On a manual run
github.ref_name is a branch, so the version gate would have nothing to check
— a deploy here is a tagged release or it does not happen.

Address

vump.codehacks.io, at the root — so the base-path environment variable and its
.env are gone, and canonical, og:url and og:image are absolute. The custom
domain goes in the repository's Pages settings; a workflow-based deploy needs no
CNAME file.

Before the first deploy

Three things outside this branch: point the DNS at Pages, set the custom domain
and Source: GitHub Actions in the repository's Pages settings, then
vump patch --project website --through push. The root README.md gets the
link once the domain answers.