feat: configure semantic-release for Artifactory hybrid versioning

[PavelKorobchuk]

Summary

Configures this repo for the Auth0 Library Pipeline (LP) — the standardized Jenkins CI/CD pipeline used by internal libraries like limitd-redis, token-replay-lib, and dadjokes-library.

Changes

• Remove publishConfig from package.json — per LP troubleshooting docs, specifying the Artifactory registry in publishConfig interferes with LP's own credential injection
• Add repositoryUrl to .releaserc.js — prevents semantic-release from falling back to the old mozilla URL
• Add cic.ci.pipeline: lp tag to opslevel.yml — registers the repo with the Library Pipeline
• Add project.yaml — LP metadata (language, node version, team channel)
• Add Makefile — LP-required build targets (install, test, lint, integration)
• Add RELEASING.md — documents the full publish process and onboarding steps

Context

PR protobufjs#7 added semantic-release configuration, but there was no CI pipeline to execute it. Investigation revealed:

1. Internal libraries at Auth0/CIC use the Library Pipeline (not GitHub Actions)
2. LP requires: project.yaml, Makefile, opslevel.yml with cic.ci.pipeline: lp tag
3. LP handles Artifactory credentials via Jenkins — no repo-level secrets needed
4. A Jenkins multibranch pipeline job must be provisioned via ESD ticket

The git tag 5.0.1-auth0-1.0.0 was successfully created during local testing.

After Merge

Open an ESD ticket for Platform Build Services to create the Jenkins job:

• Portal: https://auth0team.atlassian.net/servicedesk/customer/portal/34/group/189/create/432
• Request: "Create Jenkins LP job for protobuf.js (master branch)"
• Ref: LP docs — Setting up a new project

Once the job exists, the next push to master with a conventional commit will auto-publish to Artifactory.

Test plan

• npx semantic-release --dry-run succeeds locally with corrected repositoryUrl
• Confirmed LP pattern matches working repos (opslevel.yml + project.yaml + Makefile)
• Confirmed publishConfig must be removed per LP docs (causes auth conflicts)
• After merge + ESD: verify Jenkins LP job picks up the repo and publishes