Harden maintenance and release automation

[lilabrooks]

What changed

• runs push CI only on main while retaining pull-request checks
• centralizes the 11-file public distribution manifest
• adds Axe accessibility checks in Chromium, Firefox, and WebKit
• verifies Playwright package and container versions stay synchronized
• pins every GitHub Action to an immutable commit SHA
• adds a tested release workflow for semantic-version tags, clean ZIP archives, and SHA-256 checksums
• documents accessibility testing and automated releases

Why

This reduces duplicate CI work, prevents release-file and Playwright-version drift, expands accessibility coverage, tightens action supply-chain controls, and makes future releases repeatable.

Validation

• npm ci
• npm test: 24 passed, 18 intentional skips
• Axe: zero detectable violations in Chromium, Firefox, and WebKit
• Pages artifact: exactly 11 allowlisted public files
• npm audit: zero vulnerabilities
• Actionlint: both workflows passed
• release ZIP and SHA-256 generation simulated locally