chore: use the shared release workflows

[will-lamerton]

Completes step 10. Local copies of release-prepare.yml and changeset-check.yml are replaced with thin callers into Nano-Collective/.github, and changeset validation moves onto the shared pr-checks.

The security bit

The local changeset-check.yml ran pull_request_target and then:

- name: Checkout PR head  # nosemgrep
  uses: actions/checkout@...
  with:
    ref: ${{ github.event.pull_request.head.sha }}

Contributor-controlled code on disk in a privileged job — and # nosemgrep suppressing the scanner warning about precisely that. Not exploitable, because nothing executed the checked-out tree, but the suppression meant it would never be flagged again either.

The checkout was never needed. The shared version uses pulls.listFiles, so there is nothing on disk at all and no suppression to carry.

One validator, not seven

scripts/validate-changesets.js and the test:changesets script are removed. The validator now lives in .github, generalised to read workspace globs from pnpm-workspace.yaml instead of hardcoding plugins/.

test:changesets was not part of test:all, so this removes nothing anyone was running locally.

Check name change

Changeset Validation → pr-checks / Changeset Validation. Neither name is in Ruleset A's required list, so no ruleset change is needed and nothing becomes unmergeable.

Unchanged

• changeset:version still runs changeset version && node scripts/normalize-changelog.js — the shared workflow takes the script name as an input for exactly this reason
• Publishing: release-prepare never publishes; release.yml still owns it
• The local vscode-extension and schema-drift jobs stay put — repo-specific work belongs in the repo

Verified

pnpm install --frozen-lockfile clean; shared validator passes against this tree (87 changesets, 2 workspace packages).

[github-actions]

No changeset found

This PR does not add a changeset, so it will not appear in the changelog or trigger a release.

If the change is user-facing, add one:

pnpm changeset

Pick a bump (patch / minor / major) and write the changelog entry in our usual voice ("Added X... Thanks to @you. Closes #123."), then commit the generated .changeset/*.md file.

If this PR is docs-only or a chore that needs no release note, you can ignore this - or run pnpm changeset --empty to record that intentionally.

[github-actions]

nc-review: nothing to raise

The PR replaces three local workflows (changeset-check, release-prepare, and the inline changeset-validation job in pr-checks) with thin callers into the shared Nano-Collective/.github reusable workflows, and deletes the now-redundant scripts/validate-changesets.js. The most consequential change is security-positive: the old pull_request_target workflow checked out the PR head SHA with # nosemgrep suppressing the scanner warning about exactly that pattern, while the new shared workflow uses pulls.listFiles so contributor code is never on disk in a privileged job. Verified that test:changesets was not part of scripts/test.sh (test:all), so removing it doesn't break the local gate. pnpm-workspace.yaml exists, so the shared workspace-glob-aware validator will find the workspace packages. changeset:version and release.yml (publishing) are untouched. The PR is well-scoped, well-explained, and warranted.

---

_{🔴 blocking · 🟠 a reviewer would ask for a change · ⚪ optional}

_{Automated code review — correctness, security, design, tests, plus duplicates and scope. A human still decides; this is not a substitute for review and is not exhaustive. The required status checks separately cover lint, formatting, types, unused dependencies, the test suite and the build. This bot never merges. Maintainers can rerun with /re-review.}