Separate release and Pages commit invariants

[haoranyu]

Summary

• distinguish the immutable v2 package/tag commit from the later protected Pages/main commit
• make the post-release Pages audit restartable from a fresh terminal using reviewed SHA and SRI constants
• keep the one-time pre-cutover main == v2.0.0 assertion in the Pages procedure
• remove the obsolete direct-push instruction for protected main
• add regression assertions for both literal and variable branch forms of the old broken invariant

Verification

• npm run lint
• npm test — 146/146
• npx vitest run test/site-content.test.js — 10/10
• independent runbook review: no remaining blocker

Closes #60