Davy7/28/2026, 11:36:57 PM

* chore(release): migrate changelog and version management to release-please

Replace git-cliff with release-please for automated changelog, version
bump, tag, and draft release management. release-please maintains a
running release PR on every push to main; merging it bumps package.json,
updates CHANGELOG.md, tags vX.Y.Z, and creates a draft GitHub Release
with changelog notes. The existing tag-driven release.yml workflow then
builds bundles, uploads assets, and appends the Installation section to
the release-please notes. The final Publish step stays manual to protect
in-app updater users from premature auto-updates.

Cargo.lock is synced by a follow-up job (sync-native-versions) that runs
scripts/sync-version.mjs after release creation, because release-please
extra-files would corrupt unrelated packages sharing the same version
string (e.g. memoffset 0.9.1).

Removed: cliff.toml, pnpm changelog scripts, git-cliff notes generation
in release.yml, update-changelog job, cliff.toml parse check in ci.yml.

* fix(ci): address zizmor findings on release-please workflow

Move permissions from workflow level to job level with inline comments,
add concurrency group, and inline the prepare-release permission comment
in release.yml.

Parent1977cc6