feat(ci): migrate release flow to release-please

[williamzujkowski]

Summary

Closes #178. Replaces the tag-triggered release.yml (manual pnpm version:* && pnpm release cycle + softprops/action-gh-release@v3 publishing) with release-please-action v5.0.0, pinned to commit SHA 45996ed1f6d02564a971a2fa1b5860e934307cf7.

How it works now

Every push to main, release-please reads conventional commits since the last tag and opens/updates a long-lived Release PR that bumps package.json + .release-please-manifest.json and writes CHANGELOG.md. Merging that PR creates the v0.x.y tag and the GitHub Release in one step.

Removed

• .github/workflows/release.yml (action-gh-release path)
• version:patch, version:minor, version:major, release, changelog scripts from root package.json
• conventional-changelog devDep — release-please owns the changelog now

Added

• .github/workflows/release-please.yml — push + workflow_dispatch trigger, job-scoped contents: write + pull-requests: write (no top-level escalation, follows the Scorecard pattern from fix(ci): tighten token permissions + add CodeQL SAST workflow #166)
• release-please-config.json — release-type: node, semver policy matches CLAUDE.md (bump-minor-pre-major: true for 0.x), include-v-in-tag: true preserves the existing v0.5.7-style tag format
• .release-please-manifest.json — anchors current version at 0.5.7

Side benefits

• No more "verify softprops/action-gh-release@v3 on next tag" risk (ci: verify softprops/action-gh-release v3 works on next release tag #178)
• Drops a devDep + dozens of transitive deps from pnpm-lock.yaml
• Single-click releases instead of two-step manual flow

Test plan

• Local: pnpm install, pnpm build, pnpm test (267 passing), pnpm typecheck, pnpm lint all green
• CI passes on this PR
• After merge, release-please opens a Release PR (will include this PR's feat: commit, so the next version will be 0.6.0 per bump-minor-pre-major)
• Merging that Release PR creates tag v0.6.0 + a GitHub Release

🤖 Generated with Claude Code