chore: rip out changesets, auto-publish docker on main

Two cleanups now that the repo has no publishable npm packages.

1. Remove the changesets toolchain entirely.

There are no more npm packages to version or publish (backend/frontend/
shared are all private). Keeping changesets around for private-package
changelog bookkeeping was dead weight and actively harmful — it fast-
failed the release workflow when a pre-existing changeset targeted a
deleted package.

Delete:
- .github/workflows/release.yml (ran changesets/action on main)
- .changeset/ (config.json, README, any remaining .md files)
- @changesets/cli from devDependencies
- changeset-check job from ci.yml
- changeset / version-packages / release scripts from package.json

2. Auto-publish the docker image on main merges.

Before PR #1528 the release workflow triggered docker.yml via
workflow_dispatch when the manifest plugin version bumped. That hook is
gone. Without it, the docker image only rebuilds on manual runs, which
is a bad default now that docker is the only self-hosting path.

Update docker.yml to:
- Add `push: branches: [main]` with the same paths filter the PR
  trigger already uses.
- Let the publish job run on both workflow_dispatch and push events.
- Use different metadata-action tag strategies per event:
  * push/auto:  latest + sha-<short>
  * workflow_dispatch with blank version: same as push
  * workflow_dispatch with semver input: {version}, {major}.{minor},
    {major} (explicit release cuts, rarely needed)

Also rewrite the "Releases" section of CLAUDE.md so it matches the
new reality.

Author: brunobuddy

.changeset/README.md

@@ -140,20 +140,3 @@ jobs:
           flags: shared
           directory: packages/shared/coverage
           fail_ci_if_error: false
-
-  changeset-check:
-    name: Changeset status
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-      - run: npm ci
-      - name: Check changeset status
-        run: npx changeset status --since=origin/main
-        continue-on-error: true

.changeset/config.json

@@ -4,9 +4,22 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to publish (e.g. 5.38.1)"
-        required: true
+        description: "Optional semver tag to publish (e.g. 5.38.1). Leave blank for a plain latest+sha build."
+        required: false
         type: string
+  push:
+    branches: [main]
+    paths:
+      - "docker/Dockerfile"
+      - ".dockerignore"
+      - "docker/docker-compose.yml"
+      - "docker/DOCKER_README.md"
+      - "packages/backend/**"
+      - "packages/frontend/**"
+      - "packages/shared/**"
+      - "package.json"
+      - "package-lock.json"
+      - "turbo.json"
   pull_request:
     branches: [main]
     paths:
@@ -47,7 +60,7 @@ jobs:
 
   publish:
     name: Build & Publish
-    if: github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'push'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -69,10 +82,11 @@ jobs:
         with:
           images: manifestdotbuild/manifest
           tags: |
-            type=semver,pattern={{version}},value=${{ inputs.version }}
-            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }}
-            type=semver,pattern={{major}},value=${{ inputs.version }}
-            type=sha
+            type=raw,value=latest,enable=${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.version == '') }}
+            type=sha,prefix=sha-,enable=${{ github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.version == '') }}
+            type=semver,pattern={{version}},value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
+            type=semver,pattern={{major}},value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
 
       - uses: docker/build-push-action@v6
         id: build

.changeset/readme-providers-table.md

@@ -481,13 +481,12 @@ All pricing comes from a single source:
 
 ## Releases
 
-There are **no publishable npm packages** in this repo anymore. `packages/backend`, `packages/frontend`, and `packages/shared` are all `private: true`. Manifest ships exclusively as the Docker image at `manifestdotbuild/manifest` (built from `docker/Dockerfile`).
-
-Changesets are still installed and wired into the release workflow for internal `CHANGELOG.md` bookkeeping on private packages — they are **not** required on every PR. Use `npx changeset add --empty` if you want to record a changelog entry for a private-package change, otherwise skip it.
+There are **no publishable npm packages** in this repo. `packages/backend`, `packages/frontend`, and `packages/shared` are all `private: true`. Manifest ships exclusively as the Docker image at `manifestdotbuild/manifest` (built from `docker/Dockerfile`). Changesets are **not** used anywhere — don't add `.changeset/*.md` files or run `changeset` commands.
 
 The Docker image is built and published via `.github/workflows/docker.yml`:
-- **PR**: validates the Docker build on changes to `docker/`, `.dockerignore`, `packages/backend/`, `packages/frontend/`, `packages/shared/`, or root `package.json`/`turbo.json`.
-- **Manual publish**: `workflow_dispatch` with a `version` input, run by a maintainer when a new image tag should be pushed.
+- **PR**: validates the Docker build (no push) on changes to `docker/`, `.dockerignore`, `packages/backend/`, `packages/frontend/`, `packages/shared/`, or root `package.json` / `turbo.json`.
+- **Push to `main`**: rebuilds and publishes on the same paths filter, tagging the image as `latest` and `sha-<short>` so every merged PR produces a fresh image automatically.
+- **Manual publish**: `workflow_dispatch` with an optional `version` input. With no input it behaves the same as a push build (`latest` + `sha-<short>`). With a semver input it also adds `{version}`, `{major}.{minor}`, and `{major}` tags for explicit release cuts.
 
 ## Code Coverage (Codecov)