fix(release): derive versions from conventional commits

[esmuellert]

Summary

Replace the unconditional patch-bump workflow with git-cliff semantic versioning and make release builds embed the version they publish.

The current pipeline builds native libraries before bumping VERSION. This was observable in v3.0.1: the macOS ARM64 asset named libvscode_diff_macos_arm64_3.0.1.dylib reports 3.0.0 from get_version().

Changes

• Add cliff.toml as the release policy
  • fix, perf, revert, and refactor bump patch
  • feat bumps minor
  • breaking commits bump major, including breaking refactors
  • test/docs/chore/build/CI-only changes do not publish
• Calculate versions with git-cliff --no-exec --unreleased --bumped-version
• Validate that VERSION matches the latest reachable release tag
• Calculate the target version before native builds and pass it through every platform workflow
• Verify native and Lua versions agree; verify Android's generated version header
• Split release responsibilities into version, asset assembly, and publish composite actions
• Require all 10 native assets and publish SHA256SUMS
• Gate publishing on the original main SHA and atomically push the release commit and annotated tag
• Limit write permission and GitHub App credentials to the publish job
• Keep GitHub-generated release notes; no custom changelog is introduced
• Restrict automatic releases to main pushes and remove the obsolete next/manual-release state machine
• Remove the Node version-bump script and generated Make targets so release automation has one authority
• Rewrite version-management documentation

Benefits

• Native assets can no longer be published under a version they do not embed
• Refactors receive patch releases without forcing every other commit type to publish
• Missing platform assets fail before a tag is created
• Concurrent main updates defer safely instead of tagging stale source
• Release commit and tag land together or not at all
• Normal PR workflows and required check names remain unchanged

Verification

• make test-c — 10/10 C tests passed
• CODEDIFF_TEST_JOBS=4 ./tests/run_tests.sh — 107 spec files passed
• Native version guard mutation: stale library failed with expected 3.0.1, actual 2.67.0; rebuilding passed
• Release-version build simulation: applying 3.0.2 produced a library reporting 3.0.2, then restoring 3.0.1 reproduced 3.0.1
• git-cliff 2.14.1 semantic matrix verified for patch, minor, major, refactor, breaking refactor, and non-release commit types
• Removing --unreleased and disabling breaking protection were both mutation-tested
• Production version action run block verified:
  • no changes → 3.0.1, released=false
  • fix(release) → 3.0.2, released=true
  • VERSION/tag drift → failure
• Production publish run block verified against local bare remotes:
  • release commit and tag pushed atomically
  • moved main deferred with no remote release tag
• Asset assembly verified with all 10 files plus checksums; removing one asset failed
• actionlint passed for all workflows
• CMake regenerated Makefile and Makefile.win
• git diff --check passed

After merge, this fix is expected to produce v3.0.2 with assets that actually embed 3.0.2.