docs: explain the stage graph mental model

[joshua-temple]

Problem

New adopters lack a single page that shows how cascade moves a change from trunk through the environment chain to a release, and where rollback and hotfix branch off. The capabilities are documented piece by piece, but the mental model is not (#179).

Fix

Adds a new narrative Stage Graph page (docs/src/content/docs/stage-graph.md) derived from internal/generate/plan.go and internal/config/types.go:

• A mermaid stage-graph diagram: trunk -> environments (in environments order) -> the prerelease/release boundary, with rollback and hotfix off-ramps.
• One entry per stage tying it to its manifest field, the generated workflow file, and when it fires: orchestrate (orchestrate.yaml), promote/release (promote.yaml / release.yaml), the positional prerelease/release boundary, rollback (cascade-rollback.yaml), hotfix (cascade-hotfix.yaml), and the opt-in supporting stages: external-update, validate, merge-queue, pr-preview, drift-check (+ comment companion).
• Cross-links the deeper pages instead of duplicating them; registers the page in the Starlight sidebar; links it from index.mdx, getting-started.md, and the README docs table.

Also folds in a small security note in the drift_check configuration section: recommend pin_mode: sha when enabling drift_check.comment, since the comment companion runs actions/github-script in a write-scoped workflow_run job and the product default pin_mode: tag floats that tag.

Verification

• npm run build in docs/ (Node 22) completes; 13 pages built, including the new /stage-graph/ route. The mermaid block and the new sidebar entry are present in the built HTML.
• Stage names, generated filenames, and trigger conditions were derived from plan.go and the generators (orchestrate on trunk push + dispatch; promote on dispatch; the second-from-top env is the prerelease marker and the top env is the release marker).
• No Go code changed.

Closes #179