docs: keep the 0.x crossing in front of every release

The 0.x → 1.x commands lived only inside the `## [1.0.0]` CHANGELOG block. A
0.x install's update banner points at the NEWEST release, so from 1.0.1 on the
one reader who needs `--major` never saw it.

* CHANGELOG.md gains a fixed `## Upgrading` section above `## [Unreleased]`:
  the three one-liners, the link to `docs/upgrading.md`, and the line that
  says a 1.x install only needs `collie update`. It sits above the newest
  `## [x.y.z]` heading, which `scripts/check-version.sh` still reads
  correctly, so that script is unchanged.
* The release workflow prints the same paragraph at the TOP of every release's
  notes, above the CHANGELOG block, with an absolute link into the tag.
* Link labels that still said `DEPLOYMENT.md` now say `docs/deployment.md`,
  which is where the page has lived since 1.0.1. Targets unchanged.
* PACK_PROTOCOL.md §18.11 and §18.12 are amended to the rule bd7e3b5
  implements: only a warrant that verifies against this pack deposes a lead;
  an unproven higher generation or a foreign warrant warns once and the lead
  keeps publishing.
* Three strings bd7e3b5 added carried an em dash. User-facing text does not.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>