ci: restore the star history schedule trigger

[av1155]

What

.github/workflows/star-history.yml has never run on its schedule. Since it
shipped in #717 it has produced two runs, both manual dispatches on 6 August.
Filtering the workflow's runs on event=schedule returns zero. The published
chart is stuck at 262 stars against 264 today.

Why

The workflow file landed on main at 18:48 UTC on 6 August, inside the Actions
incident that ran from 15:22 UTC that day to 02:04 UTC the next
(https://stspg.io/rcz3fcm83sff). The closing note on that incident says
workflow-triggering events during the window were not processed and cannot be
replayed, and that the triggering action needs repeating with a new commit. A
workflow's schedule is registered off the default-branch push that introduces
it, so the cron was never registered.

The usual self-heal did not apply either. The only later push to main,
b06cd4f at 20:22 UTC, was also inside the window, with webhooks still throttled
to roughly 15%. Nothing has been pushed to main since.

Everything else checks out: the workflow is active, the file is on main, the
cron is valid, Actions are enabled, and the other seven scheduled workflows in
the repo all fire normally.

Proposed change

• Change the cron minute so the parsed schedule differs from whatever is cached,
  and push it to main. GitHub's guidance for a lost schedule is that any
  default-branch commit resyncs it.
• Add watch: types: [started]. Stargazers are this chart's only input, so a
  star is the signal that it is stale. This stops the chart from depending
  solely on the cron registration surviving. The cron stays as the backstop,
  since unstarring does not fire watch.
• Set cancel-in-progress: true. Each run rebuilds from the full stargazer
  list, so a newer run supersedes an older one and a rush of stars should not
  queue one serial run each.

The watch trigger is reachable by anyone with a GitHub account. That is
acceptable here because no event payload value reaches the job: it reads
stargazers from the API, renders with a script in this repo, and writes two SVGs
to the unprotected assets branch.

Acceptance criteria

• A manual dispatch after merge reaches the publish step and pushes. The
  assets branch tip message changes from chore: seed star history chart assets to chore: refresh star history chart.
• The rendered chart reports the live star count.
• A scheduled run appears within two daily windows.
• Starring the repo triggers a run.

Out of scope

• Link Check and the scheduled Security run are both failing for unrelated
  reasons. Separate issues.
• Two rendering and guard problems in the same file, found while investigating:
  duplicate x-axis labels on short star windows, and the truncation floor guard
  having no override once tripped. Separate issues.