chore: adopt changesets for release management

[Saturate]

Enhanced release management via changesets. No manual release steps needed; it's all handled through the PR flow.

Changesets in a nutshell

Each PR that changes user-facing behavior includes a small markdown file in .changeset/:

---
"jumbo-cli": patch
---

Fixed goal output missing progress entries.

The frontmatter declares the package and bump type (patch/minor/major). The body becomes a line in the release notes. These files accumulate on main as PRs merge.

When it's time to release, the release.yml workflow collects all pending changesets, combines them into a single CHANGELOG entry, bumps the version in package.json accordingly (the highest bump type wins), and opens a release PR. Merging that PR publishes to npm.

Release flow

flowchart TD
    A[PR with changeset merges to main] --> B{Pending changesets?}
    B -- Yes --> C[Opens 'ci: Version Packages & Release' PR<br/>with combined changelog + version bump]
    C --> D[Josh reviews & merges when ready]
    D --> E[Merges to main]
    E --> F{Unpublished version?}
    F -- Yes --> G[Build + test + publish to npm]
    G --> H[Creates git tag + GitHub Release]
    F -- No --> I[Nothing happens]
    B -- No --> I

Loading

Multiple PRs can merge before a release. Their changesets stack up and get combined into one version bump. For example, three patch changesets become one patch release; a minor + two patch becomes a minor release.

CI gate

pr-gate.yml runs changeset status on every PR. Every PR needs a changeset file. For non-user-facing PRs (docs, CI), an empty changeset satisfies the check:

---
---

What changed in this PR

• Added @changesets/cli and @changesets/changelog-github as dev dependencies
• Added .changeset/config.json
• Added release.yml workflow
• Added changeset status check to pr-gate.yml
• Removed publish.yml (replaced by release.yml)
• Updated CONTRIBUTING.md and AGENTS.md with changeset instructions
• Upgraded all workflow actions to latest versions (checkout v7, setup-node v6.4, Node 22)

npm provenance

publish.yml used npm publish --provenance directly. With changesets, changeset publish handles the publish call, so provenance is now configured via publishConfig in package.json:

"publishConfig": {
  "access": "public",
  "provenance": true
}

Same result: published packages are signed and linked back to the GitHub Actions run that built them. No npmjs.org configuration needed.