S23.05: Versioned publishing on release

[DavidCozens]

Parent epic: #246

Goal

Publish a versioned documentation snapshot on every stable GitHub
Release, and update /latest/ to point at the new version.

Tasks

• Add a job (in the existing release workflow or a new one) triggered
  on release.published.
• The job:
  • Reads the release tag.
  • Stamps the version into conf.py (version, release).
  • Builds the docs.
  • Publishes to gh-pages under /vX.Y.Z/.
  • Updates /latest/ to point at the new version (mirror copy or a
    redirect — pick the simpler one that still works for direct deep
    links).
• Stable releases only — pre-releases and draft releases must not
  update /latest/ and should not publish a versioned directory either
  (or publish it but skip the /latest/ update — decide and document).
• Must coexist cleanly with the SBOM job already running on the same
  event. If both push to gh-pages, serialise them or partition by
  path to avoid race conditions.
• Update DEVLOG.md.

Done when

• Cutting a stable release through release-please results in a new
  /vX.Y.Z/ directory on gh-pages and an updated /latest/.
• A pre-release / draft release does not update /latest/.
• The SBOM job and the docs job both succeed on the same release
  event without clobbering each other.

[DavidCozens]

Deferred to 1.0 per the overhaul plan. Versioned publishing on release (mike-style /vX.Y/ + latest) keeps versioned copies of the docs online. Also carries the open question, folded in from S23.06, of whether to attach an offline built-site / signed docs snapshot per release. See #246.