feat(release): semantic-release automation and 0.2.0 changelog

[andreas-timm]

Summary

• Adds the shared semantic-release automation (release-package skill v0.2.0): CI + Semantic Release workflows, GPG-signed release commits/tags, changelog handling, npmjs trusted publishing and GitHub Packages publish jobs, release:preview / release:publish scripts, and a ## Releasing section in CONTRIBUTING.md.
• Migrates the package manager from bun to pnpm for installs (bun stays the run engine).
• Adds a hand-written CHANGELOG.md with the 0.2.0 section (kept verbatim as release notes by the custom notes plugin) and a backfilled 0.1.3 section.

Verification

• Pre-release audit: metadata, secrets scan, lockfile install, lint + typecheck, 59 tests, build, dependency audit, pack contents — all pass.
• semantic-release dry-run from this branch: finds tag 0.1.3, analyzes 4 commits (2 feat, 1 fix, 1 test) → next version 0.2.0; preview confirms CHANGELOG.md already contains 0.2.0, so the hand-written notes will be used.
• release:publish --dry-run: tarball packs cleanly (39 files); npm correctly refuses to overwrite the published 0.1.3 (version bumps only in the CI release job).

Repository configuration status

• RELEASE_GPG_PRIVATE_KEY secret set
• RELEASE_GIT_NAME / RELEASE_GIT_EMAIL variables set
• npm trusted publishing for semantic-release.yml on npmjs.com (verify in npm settings — not checkable via CLI)
• main must allow the workflow's GITHUB_TOKEN to push the release commit

Merge note

Merge with a merge commit or fast-forward — do not squash — so commit-analyzer sees the individual feat:/fix: commits and derives 0.2.0. On merge, the Semantic Release workflow will tag 0.2.0, create the signed release commit, publish the GitHub release with the hand-written notes, and publish to npmjs + GitHub Packages.

[github-actions]

🎉 This PR is included in version 0.2.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀