Streamline release pipeline — changeset-per-PR, 2-workflow (version→release), open-source changelogs

[rucka]

Story Statement (DRAFT — to refine)

As a Pair maintainer
I want the release pipeline streamlined to changeset-per-PR + a 2-workflow (version.yml → release.yml) workflow_dispatch model with open-source changelogs
So that releases are maintainer-controlled, reproducible, and the changelog follows open-source conventions

Parent Epic: #68 (Platform Hardening & Enterprise Readiness)
Builds on: the release-tooling consolidation delivered in #148 / PR #333 (release scripts + tested determine-version).

Context

Split from #148: the tooling slice shipped (#333, #148 closed); this story carries the remaining pipeline rewrite. The current workflows are still the pre-rewrite form (tag-on-changeset-merge.yml still present; version.yml/release.yml not yet workflow_dispatch-only).

Acceptance Criteria (to refine — re-verify vs current CI first)

Given-When-Then (from the original #148 scope; confirm each still applies):

1. Changeset-per-PR check in ci.yml: fails if no .changeset/*.md in the PR; escape-hatch label passes without one.
2. version.yml (workflow_dispatch-only): consumes accumulated changesets, bumps fixed-group package versions atomically, syncs root package.json, generates CHANGELOGs (PR-linked, type-grouped) via @changesets/changelog-github, commits, pushes tag v{X.Y.Z}, triggers release.yml.
3. release.yml (workflow_dispatch + version input): no tag-push/release-event triggers.
4. Delete tag-on-changeset-merge.yml: a non-changeset PR merged to main triggers NO release workflow; exactly 2 runs per release (one version, one release).
5. ci.yml fix: remove || echo fallbacks masking failures.
6. PAT elimination: cross-workflow trigger via GITHUB_TOKEN (drop GH_RELEASE_TOKEN).
7. /implement bump-type: the skill infers patch/minor/major from the story/commit convention when creating the changeset. ⚠️ this touches process/implement SKILL.md → skill-layer mutex (coordinate with Wire template-override resolution into skills (docs already claim it works — it doesn't) #314/tech-debt: relocate skill-conventions/ into guidelines (technical-standards/ai-development) #365).

Business rules

• Version workflow manual-only; release triggered-only; changelog via @changesets/changelog-github (Radix/Turborepo convention).

⚠️ Notes for refinement

• Release-critical: rewrites the CI that publishes @foomakers/pair-cli to npm — verify the publish path end-to-end (dry-run) before merge.
• Re-verify currency: the original ACs are from 2026-02; the CI has since gained the tier-aware pre-merge pipeline (Tier-aware pre-merge pipeline — reads classification tags only, fail-safe red #258) and preview-deploy — reconcile the rewrite with those before implementing.
• Mostly parallel-safe (CI/.github/workflows/.changeset/release-tools) EXCEPT the /implement bump-type touch (skill-layer).
• Parent-epic check: Platform Hardening & Enterprise Readiness #68 sits under the Knowledge Service initiative, but this is a CLI/product release concern — confirm Platform Hardening & Enterprise Readiness #68 is the right home or re-parent.

Status

Draft — NOT refined. Refine with /pair-process-refine-story (grill), reconciling ACs against the current CI.