Harden the Changesets release workflow

[andrewiggins]

Summary

• migrate release automation to Changesets CLI v3 and the split Changesets v2 actions
• separate versioning, build/pack, and publishing into least-privilege jobs as recommended by this latest version of Changesets: https://changesets.dev/guide/automating#trusted-publishing
• publish the exact artifacts produced by a read-only build job
• share locked dependency setup and full validation through local composite actions
• update all GitHub Actions to their latest stable releases with full SHA pins

Security controls

• reset workflow permissions and grant capabilities per job
• keep package builds outside jobs with repository-write or npm OIDC permissions
• disable persisted checkout credentials
• install from the frozen lockfile with dependency lifecycle scripts disabled
• disable package lifecycle scripts during publication
• pin runners and every external Action

Validation

• clean install with a new pnpm store and --frozen-lockfile --ignore-scripts
• formatting, build, lint, type-check, and tests
• Changesets status and publish-plan generation
• synthetic Changesets pack flow with expected package contents
• production dependency audit with zero findings