feat(ci): adopt Changesets releases

[caio-pizzol]

Why

The existing semantic-release workflow tries to push version commits directly to protected main, so releases fail after branch protection was enabled. Changesets moves version updates into a normal pull request that can pass CI and Cubic review.

This also gives the future OOXML CLI its own version and changelog without forcing web, MCP, and internal shared code to release together.

What changes

• Replace semantic-release with Changesets v3 and Changesets Action v2.
• Keep web and MCP as independent, private GitHub-only release packages.
• Keep @ooxml-dev/shared internal and excluded from releases.
• Use the repository-scoped GitHub App to create version pull requests and trigger normal checks.
• Move future tags to the Changesets package format:
  • @ooxml-dev/web@<version>
  • @ooxml-dev/mcp-server@<version>

The old web-v* and mcp-v* tags remain as release history. Baseline package tags for both existing 1.3.0 releases were created on their original release commits before opening this PR.

Production deployment is unchanged. Web and MCP still deploy from relevant pushes to main through the existing Deploy workflow.

Release boundaries

Package	Release behavior
@ooxml-dev/web	Version, changelog, tag, and GitHub Release; no npm publish
@ooxml-dev/mcp-server	Version, changelog, tag, and GitHub Release; no npm publish
@ooxml-dev/shared	Internal only; no version or tag
Future CLI	Independent version and registry publishing when its package contract exists

Verified

• bun install --frozen-lockfile
• bun run lint (passes with the existing unused-import warning in scripts/ingest-xsd/ingest.ts)
• bun run typecheck
• bun run build
• bun test tests/scripts/db-migrate.test.ts
• Disposable release simulation:
  • web patch: 1.3.0 → 1.3.1
  • MCP minor: 1.3.0 → 1.4.0
  • shared stayed at 0.0.1 and received no tag
  • generated changelogs and tags matched the documented package names

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>