feat: release-please versioning + zero-cooldown automerge for consumers

[roleme]

What

Introduces automatic SemVer versioning for this shared-workflows repo and wires consumers to pick up new versions immediately.

release-please (this repo)

• .github/workflows/release-please.yml runs on push to main, maintains a release PR, and cuts a vX.Y.Z tag when that PR merges.
• Commit prefixes drive the bump: fix:/chore: → patch, feat: → minor, feat!:/BREAKING CHANGE: → major.
• Patch/minor release PRs are marked auto-merge — they merge themselves once branch protection's zizmor check is green.
• Major release PRs are left open for manual approval.
• On each release, the moving major tag (vN) is force-moved to the released commit.
• Seeded at 1.0.0 (release-please-config.json + .release-please-manifest.json); merging the first release PR cuts v1.0.0 and v1.

Shared Renovate preset

• New rule scoped to roleme/workflows: minimumReleaseAge: 0 (no 10-day soak) + automerge for non-major bumps. Consumers' own required checks are the green gate.
• Major bumps of roleme/workflows never auto-merge (labelled breaking-change).

Consumer rollout (follow-up)

After this merges and v1.0.0 is cut, consumer repos repoint their reusable refs from @<sha> # main to @<sha> # v1.0.0. Starting with docker_infra; then asia-trip-bot, training_tracker.

Notes

• Requires branch protection on main with zizmor as a required check + repo auto-merge enabled (configured alongside this PR) so the auto-merge gate is real.
• zizmor passes locally on the new workflow; renovate-config-validator passes on the preset.

🤖 Generated with Claude Code