Template and themes drift behind releases: keep cloudhal-template and frozen theme copies current #111

What happened: cloudhal-dev/cloudhal-template (the Deploy to Cloudflare button) stayed on ^0.3.4 with a 0.3.4 theme until 0.6.0 (fixed in cloudhal-template#1). So every site created with the button started three releases behind, without /fonts/v1, collections, typed fields or feeds.

Hardening:

• A release workflow job: after a successful npm publish, it opens a PR on cloudhal-template that copies starters/blog/src and public at the new tag and bumps @cloudhal/*. The PR runs npm install and WORKERS_CI=1 npx cloudhal deploy --dry-run as its check.
• Dependabot on cloudhal-template: the same @cloudhal/* group as cloudhal.com, as a fallback for the dependencies.
• A short note in the release checklist: try.cloudhal.com (pnpm run deploy), cloudhal.com (Dependabot PR; minor bumps wait for a person) and the template.

Done when: a release opens the template PR on its own and the PR's check passes.