ci: migrate changesets release tooling to v3

[bokelley]

Summary

• upgrade @changesets/cli to v3 and changesets/action to v2 atomically
• migrate the release workflow to the renamed action inputs, explicit app token, and changeset git-tag
• migrate prerelease state/config and align the live CI, hook, documentation, and agent guidance references

Why

Dependabot PRs #6597 and #6598 are unsafe independently. CLI v3 removes changeset tag, while action v2 requires CLI v3 and renames its inputs/token configuration. Either standalone PR would break the release path despite green pull-request checks.

Impact

The published protocol contract is unchanged. Release automation keeps the existing custom versioning, signing, tagging, and GitHub Release behavior on the supported v3 interfaces.

Validation

• npm ci --ignore-scripts plus native dependency rebuild
• Changesets v3 status and git-tag --help under Node 24
• actionlint -ignore 'SC2034|SC2155' .github/workflows/release.yml .github/workflows/changeset-check.yml
• changeset protocol-scope tests and policy check
• pre-commit suite: 6,219 tests passed, 30 skipped; typecheck passed
• current and 3.0-compatible storyboard matrices passed
• schema-link and Mintlify navigation checks passed

Supersedes #6597 and #6598.

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated paths touched without required review approval.

This PR migrates Changesets CLI v2→v3 and changesets/action v1→v2 atomically. The reviewer verified the migration thoroughly (safe pre.json stripping, Node 24 satisfies v3 engine floor, config schema v4 fields valid, complete reference sweep, immutable dist/ untouched, patch changeset satisfies protocol-scope gate) and surfaced no blocking or Medium findings.

However, the PR modifies files under hard gated paths (.agents/**, .changeset/config.json, .changeset/pre.json, .github/workflows/**) while review_decision is REVIEW_REQUIRED — not APPROVED. Per decision rule row 2, this is a deterministic hard gate that requires human/CODEOWNERS review before merge. The clean diff cannot override it until the gate is satisfied.

Escalation reasons:

• Modifies gated-path files (.agents/playbook.md, .agents/shortcuts/cut-major.md, .agents/shortcuts/prep-for-pr.md, .changeset/config.json, .changeset/pre.json, .github/workflows/changeset-check.yml, .github/workflows/release.yml) with review_decision: REVIEW_REQUIRED — human/CODEOWNERS approval required.

No blocking or medium findings otherwise; once a human approves, this diff is clean.

>

Why human review

• Modifies gated-path files under .agents/, .changeset/config.json, .changeset/pre.json, and .github/workflows/ while review_decision is REVIEW_REQUIRED (not APPROVED) — human/CODEOWNERS review required to satisfy the hard approval gate.
• This PR touches a path under a hard, non-overridable approval gate (.agents/playbook.md (modified) matches .agents/**; .agents/shortcuts/cut-major.md (modified) matches .agents/**; .agents/shortcuts/prep-for-pr.md (modified) matches .agents/**; .changeset/config.json (modified) matches .changeset/config.json; .changeset/pre.json (modified) matches .changeset/pre.json; .github/workflows/changeset-check.yml (modified) matches .github/workflows/**; .github/workflows/release.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.