…hase 0 A2) (#291)

## Summary

Phase 0 A2. Restores the version-bump step semantic-release needs to
actually write the new version into the package.json files BEFORE the
git plugin commits them.

## What was broken

The v0.15.0 tag points at a commit where both \`package.json\` and
\`apps/desktop/package.json\` still read \`0.14.0\`:

\`\`\`
$ git show v0.15.0:package.json | jq -r .version
0.14.0
$ git show v0.15.0:apps/desktop/package.json | jq -r .version
0.14.0
\`\`\`

Symptom: electron-updater sees mismatched versions; any consumer reading
from package.json drifts from the tag; ship-it-and-forget-it release
becomes "wait, what version is this?".

### Why

semantic-release pipeline is a chain. Each plugin has a contract.

| Plugin | Contract |
|---|---|
| \`commit-analyzer\` | decides next version |
| \`release-notes-generator\` | writes release notes |
| \`changelog\` | mutates CHANGELOG.md |
| \`exec.prepareCmd\` | **mutates package.json (this step was missing)**
|
| \`git\` | commits the mutated files via \`assets:\` list |
| \`github\` | creates draft release |

The \`assets:\` list in \`@semantic-release/git\` ONLY commits files; it
doesn't create the diff. Without an explicit mutation step, the git
plugin sees no changes to package.json and commits an effectively empty
diff (just the CHANGELOG update).

The original \`scripts/bump-version.js\` performed that mutation, wired
via \`@semantic-release/exec\`. It was deleted in the knip cleanup
(#279) under the false assumption nothing referenced it — knip didn't
scan \`release.config.js\` as an entry point.

PR #289 patched \`release.config.js\` to remove the dangling
\`prepareCmd\`, which made the workflow stop crashing but left versions
stale.

## Fix

1. **\`scripts/bump-version.mjs\`** (new) — pure-ESM, zero dependencies,
updates ONLY the \`version\` field of exactly two files
(\`package.json\` and \`apps/desktop/package.json\`). Preserves existing
trailing-newline. Fails non-zero on missing version arg, unparseable
JSON, or absent version field.

2. **\`release.config.js\`** — re-wires the \`@semantic-release/exec\`
plugin (already a devDep) with \`prepareCmd: 'node
scripts/bump-version.mjs \${nextRelease.version}'\`. Comment block in
the file documents the history so the next maintainer doesn't repeat the
mistake.

Packages with independent release cycles (notably \`packages/api\` on
Cloudflare Workers, \`packages/mcp-server\`) are deliberately NOT in the
target list. If we ever need to bump them, that's a separate concern
with a separate script.

## Verification

\`\`\`
$ node scripts/bump-version.mjs 0.15.1
bump-version: package.json 0.14.0 -> 0.15.1
bump-version: apps/desktop/package.json 0.14.0 -> 0.15.1
bump-version: updated 2 of 2 target(s)
\`\`\`

Edge cases:
- \`node scripts/bump-version.mjs\` (no arg) → \`missing version
argument\`, exit 1
- \`node scripts/bump-version.mjs 0.14.0\` (already at version) →
\`already at 0.14.0, skipped\`, exit 0
- Same version on already-bumped files → idempotent, no diff

- ✅ \`pnpm -r typecheck\` — green
- ✅ \`pnpm test\` — 17/17 packages

## Stack context

Phase 0 A2 of the post-audit devops roadmap. Pairs with #290 (A1,
electron pin). Independent files, can land in any order.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…se 0 A4) (#293)

## Summary

Phase 0 A4. Two guardrails on \`release.yml\` to make a silent or
partial release impossible.

## Why

The v0.15.0 release pipeline failed silently twice:

1. **Silent no-op**: PR #245's squash-merge title (\`release: audit +
Ed25519 signed envelopes + lefthook (v0.15.0) (#245)\`) didn't match a
conventional commit type in \`releaseRules\`. semantic-release exited
cleanly with \"no release\" and the workflow ended green; the operator
only noticed because no tag appeared. We patched this with #289 by
adding a forcing \`feat:\` commit, but the trap will fire again on the
next big squash unless the workflow refuses to silently no-op.
2. **Stale version**: even when the release finally cut, both
\`package.json\` files still read \`0.14.0\` because the deleted
\`scripts/bump-version.js\` was never re-introduced (fixed in PR #291).
Tag points at one version, file content reads another — visible by
anyone running \`jq .version package.json\` against the tag.

## Guardrails

### Pre-flight (dry-run)

\`\`\`yaml
- name: Pre-flight (dry-run) check
  run: |
    npx semantic-release --dry-run 2>&1 | tee /tmp/sr-dry.log
    if grep -qE \"There are no relevant changes\" /tmp/sr-dry.log; then
echo \"::error::semantic-release dry-run: no release will be cut.\"
      exit 1
    fi
    if ! grep -qE \"next release version is\" /tmp/sr-dry.log; then
echo \"::error::semantic-release dry-run did not announce a next release
version.\"
      exit 1
    fi
\`\`\`

Stops the workflow loud and clear before \`--ci\` if commit-analyzer
would have returned \"no release\". Actionable error messages point at
\`release.config.js > releaseRules\` and the commit log.

### Post-flight (version assertion)

\`\`\`yaml
- name: Verify version bump applied
  run: |
expected=$(grep -oE \"next release version is [0-9]+\\.[0-9]+\\.[0-9]+\"
/tmp/sr-dry.log | tail -n 1 | awk '{print $NF}')
    root_v=$(jq -r .version package.json)
    desk_v=$(jq -r .version apps/desktop/package.json)
if [ \"$root_v\" != \"$expected\" ] || [ \"$desk_v\" != \"$expected\" ];
then
      echo \"::error::Version mismatch after semantic-release.\"
      exit 1
    fi
\`\`\`

Re-uses the captured dry-run log to know what version SHOULD have been
written. Catches a misconfigured or skipped \`scripts/bump-version.mjs\`
(PR #291) BEFORE the tag-triggered build downloads the stale
package.json.

## What gets caught

| Trap | Caught by |
|---|---|
| Non-conventional PR title (#245 trap) | Pre-flight: \"no relevant
changes\" |
| Wrong releaseRules / type filter | Pre-flight: \"did not announce next
release\" |
| \`prepareCmd\` missing or wrong path | Post-flight: version mismatch |
| \`bump-version.mjs\` only updated one file | Post-flight: per-file
diff |
| semantic-release crashed mid-cycle | Native exit code from \`Run
semantic-release\` step |

## Verification

I dry-ran the gate logic locally against the current main commit log;
the dry-run output contains the expected lines for both happy-path and
no-op cases. No way to test end-to-end without actually invoking the
workflow.

## Stack context

Phase 0 A4. Independent from A1 (#290), A2 (#291), B-bundle (#292).
Different files / steps; no overlapping changes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>