Document the service to chart to stack release cascade

Three pull requests add a CI cascade that moves a version from a service release all the way to the self-managed stack, and nothing describes it end to end. docs/dev/architecture.md covers runtime request flow, not CI, so there is no existing diagram to extend.

Raised as a review comment on #1215 (three times, on different files). Answering it per-PR would produce three partial pictures of one flow, so it belongs in a single page once the pieces land.

The flow to document

service release tag            src/<plane>/<service>/v<version>
  -> chart-version-bump.yml    bumps appVersion + matching image tag
                               in charts whose deploys list names that service
  -> PR on chore/chart-version-bumps

  (a human cuts the chart release)

chart release tag              deploy/helm/<dir>/v<version>
  -> stack-pin-bump.yml        moves the helmfile pin for that chart
  -> PR on chore/stack-pin-bumps

The human step in the middle is deliberate and is the part most likely to surprise people: merging a chart bump does not move the stack.

Points worth stating explicitly

• Why the chart-to-service edge is declared in github-release-subprojects.json rather than derived. Three derivations fail, and one of them is confidently wrong.
• Why absent and empty deploys are different states.
• What a refusal means (appVersion and image tag disagree, exit 3) versus a failure, and why the distinction exists.
• Why the stack resolver refuses to act while any release is unresolved.
• Which tool owns which hop, and the entry points under tools/ci/.

Blocked on

#1213, #1215 and #1222 merging. A page describing workflows that are not on main would link to files that do not exist there.

References

#1213, #1215, #1222

After #1213, #1215 and #1222 merge, start with the entry points under tools/ci/ and compare them with the release and workflow paths described in the issue. Add a single end-to-end page, including the deliberate human chart-release step, ownership of each hop, refusal versus failure behavior, and the absent-versus-empty deploys distinction.