…le -W (#137)

* Migrate translation workflows to @v0, adopt the review template, enable -W

Moves review and rebase off the exact `@v0.16.1` pin onto the floating
`@v0` tag, per the pin policy settled in
QuantEcon/project-translation#9, and aligns the review workflow with the
upstream template in action-translation
docs/user/tutorials/connect-existing.md.

Two substantive changes beyond the pin:

**Concurrency moves from workflow level to job level**, and
`cancel-in-progress` from false to true. The previous comment argued
that job-level `true` was unsafe because an 'automated' label event
would cancel the in-flight review for 'action-translation' and then
skip its own job via the filter, leaving no review at all. That was
reasoned from the GitHub docs and never tested, and production
disproved it: across roughly 15 live opportunities on
lecture-intro.zh-cn the group was entered only after the `if` passed,
the 'automated' event skipped without cancelling, and a review was
posted every time. The stale rationale is replaced rather than left in
place.

**A `permissions` block is added** — v0.17.0's review dedupe deletes
superseded comments, which requires `pull-requests: write`.

The pin was two releases behind, which matters here: v0.18.0 carries
the fix for a review-mode defect where a model response missing a
criterion score became NaN and rendered as an automatic FAIL on
otherwise clean PRs. See QuantEcon/action-translation#102.

Separately, `ci.yml` gains `-W` on the notebook build. This repo's
publish.yml already builds strict, so the PR gate was weaker than the
publish gate — a corrupted sync could merge green and then break the
published site. Coverage is 26 of 26 lectures with a `_toc.yml`
identical to source, so there are no untranslated-lecture references
for the flag to trip on. The strict build is the last line of defence
against the silent-corruption class in
QuantEcon/action-translation#118 and #119, both of which surfaced only
because a downstream repo built with -n -W.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Rebase: also match resync/* branches (action-translation v0.18.1)

The rebase workflow only fired for `translation-sync-*` branches, which
the Action's sync mode creates. The CLI's `translate forward --github`
creates `resync/{stem}` branches, so merging one resync PR never
rebased its siblings — during a drift-recovery wave that leaves a stack
of open PRs whose bases go stale with every merge.

Fixed engine-side in action-translation v0.18.1, but the action-side
half is not sufficient on its own: this `if` gates whether the job runs
at all, and it runs before the action does. Both layers must list both
prefixes or the result is a job that never starts.

Brings this file in step with the upstream template as of that release.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>