chore: rip out changesets, auto-publish docker on main merges

[brunobuddy]

Summary

Two cleanups now that the repo has no publishable npm packages.

1. Remove the changesets toolchain entirely

Nothing in this repo publishes to npm anymore — packages/backend, packages/frontend, and packages/shared are all private: true. Keeping changesets around for private-package changelog bookkeeping was dead weight, and it actively bit us: the release workflow fast-failed on #1528's merge because a pre-existing changeset targeted a package that had just been deleted.

Deleted:

• .github/workflows/release.yml — the workflow that ran `changesets/action` on every main merge
• .changeset/ — config, README stub, and the empty `readme-providers-table.md`
• `@changesets/cli` from `devDependencies`
• `changeset-check` job in `.github/workflows/ci.yml`
• `changeset`, `version-packages`, and `release` scripts in `package.json`

Docs: rewrote the `Releases` section of `CLAUDE.md` to state plainly that changesets are gone and not to add `.changeset/*.md` files.

2. Auto-publish the Docker image on main merges

Before #1528, the old `release.yml` triggered `docker.yml` via `workflow_dispatch` whenever the `manifest` plugin version bumped. That hook died with the plugin removal. Since Docker is now the only self-hosting path, it's bad UX for the image to only rebuild on manual workflow runs.

`.github/workflows/docker.yml` changes:

• Add `push: branches: [main]` with the same paths filter the PR trigger already uses (`docker/`, `.dockerignore`, `packages/backend/`, `packages/frontend/`, `packages/shared/`, root `package.json` / `package-lock.json` / `turbo.json`).
• Let the `publish` job run on both `workflow_dispatch` AND `push` events.
• Use different `metadata-action` tag strategies per event:
  • push (auto): `latest` + `sha-`
  • workflow_dispatch with blank `version` input: same as push
  • workflow_dispatch with semver `version` input: `{version}`, `{major}.{minor}`, `{major}` (explicit release cuts, rarely needed)
• The PR `validate` job is untouched — still builds multi-arch without pushing.

So every merged PR that touches runtime files now automatically produces a fresh `manifestdotbuild/manifest:latest` image plus a `sha-` tag for rollback. Maintainers can still do explicit versioned cuts by running `docker.yml` manually with a version input.

Test plan

• `npm install` — lockfile regenerates clean (dropped `@changesets/cli` and its deps)
• `npm run build --workspace=packages/shared` — clean
• `npx tsc --noEmit` in backend and frontend — clean
• `npm test --workspace=packages/backend` — 3687/3687 passing
• `npm test --workspace=packages/frontend` — 2152/2152 passing
• `npm run lint` — 0 errors (11 pre-existing frontend warnings; lint scope now matches active workspaces only)
• Verified on merge: `docker.yml` `publish` job runs against `main` and pushes `latest` + `sha-` to Docker Hub
• Verified on merge: no more release workflow failure (there is no release workflow)

---

Summary by cubic

Removed the Changesets tooling and set Docker to auto-publish on merges to main, reducing CI noise and ensuring every runtime change ships a fresh image.

• Refactors

  • Removed .github/workflows/release.yml, the entire .changeset/ folder, changeset-* scripts in package.json, and the changeset-check job in ci.yml; dropped @changesets/cli.
  • Updated CLAUDE.md to reflect Docker-only releases and that .changeset/*.md files are not used.

• New Features

  • docker.yml now runs on push to main (paths-filtered) and on workflow_dispatch.
  • Tagging: on push or blank manual input → latest + sha-<short>; with semver input → {version}, {major}.{minor}, {major}. PR validation remains build-only (no push).

^{Written for commit f503b1d. Summary will update on new commits.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.43%. Comparing base (4043fae) to head (f503b1d).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1535   +/-   ##
=======================================
  Coverage   98.43%   98.43%           
=======================================
  Files         118      118           
  Lines        8653     8653           
  Branches     3278     3278           
=======================================
  Hits         8518     8518           
  Misses        134      134           
  Partials        1        1           

Flag	Coverage Δ
frontend	98.43% <ø> (ø)
shared	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cubic-dev-ai]

No issues found across 9 files

[brunobuddy]

Closing unmerged — reverting direction.

After the user pointed out that changesets is worth keeping for CHANGELOG bookkeeping and that Docker releases should stay explicit, I realized the current main already matches that intent exactly:

• release.yml runs changesets/action on main merges with version: npm run version-packages and no publish: step. So it opens "Version Packages" PRs that bump versions and update CHANGELOG.md on the private packages, but it doesn't publish anything to npm and doesn't trigger Docker.
• changeset-check job stays wired into ci.yml as a soft check (continue-on-error: true) — it reminds contributors to add a changeset without blocking the PR.
• docker.yml publishes only on manual workflow_dispatch with a version input. No auto-publish.

The original orphan-changeset failure was a one-off caused by pre-existing changesets targeting the now-deleted manifest package; #1534 fixed that by deleting them. Since then the release workflow has been green.

So this PR is unnecessary and would actually undo the changesets flow the user wants to keep. Not merging.