fix: enforce required changesets

[santi020k]

Summary

• fail package pull requests when Changesets reports no pending release
• automatically label Dependabot updates as changelog-free
• preserve the explicit skip-changelog escape hatch for documentation and infrastructure work

Validation

• pnpm run validate
• actionlint
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 888992dfdf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not skip releases for runtime dependency updates

Because this label is configured for the entire npm ecosystem entry, Dependabot also applies it to production-dependency PRs, not only the grouped development updates. Those dependencies are bundled into the published CLI, so merging a runtime fix without a changeset leaves the package version unchanged; I also checked .github/workflows/release.yml, whose push paths exclude the lockfile and workspace catalog, meaning the merge does not trigger publishing and users may never receive the update until an unrelated release. Restrict this exemption to development-only updates or otherwise require release-producing npm updates to include a changeset.

AGENTS.md reference: AGENTS.md:L11-L11

Useful? React with 👍 / 👎.