feat(release): automated release pipeline with semantic-release (#157)

## Summary

- Replace manual release process with a two-stage automated pipeline
using **semantic-release**
- **Stage 1** (`release.yml`): `workflow_dispatch` on main →
semantic-release analyzes commits, bumps version, creates tag + draft
GitHub Release (~30s)
- **Stage 2** (`build.yml`): tag push triggers parallel mac/win/linux
builds → signs + notarizes macOS → uploads artifacts → undrafts release
→ tweets → auto-PR syncs main→develop

## Changes

- Add `release.config.js` (conventionalcommits preset, draft release,
beta channel ready)
- Add `scripts/bump-version.js` with tests (syncs version across
monorepo)
- Replace `.github/workflows/release.yml` (200 lines → 46 lines
semantic-release workflow)
- Create `.github/workflows/build.yml` (parallel platform builds +
publish + tweet + sync-develop)
- Delete `.github/workflows/auto-tag.yml` (replaced by semantic-release)
- Update CLAUDE.md Git Flow section with release process + rollback docs
- Add semantic-release + plugins as devDependencies

## Required: New GitHub Secret

Create a `GH_TOKEN` repository secret — a Personal Access Token with
`contents: write` scope. Needed because:
1. semantic-release must push tags that trigger other workflows
(GITHUB_TOKEN can't do this)
2. electron-builder needs write access to upload artifacts to GitHub
Releases

## Test plan

- [x] All existing tests pass (`pnpm test`)
- [x] `scripts/bump-version.test.js` — 2 new tests passing
- [x] `release.config.js` loads correctly
- [x] All workflow YAML files are syntactically valid
- [ ] Create `GH_TOKEN` secret in repo settings
- [ ] After merge to main: click "Run workflow" on Release action to
test end-to-end

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Implemented automated release pipeline with semantic versioning,
generating changelogs automatically.
* Added multi-platform build automation for simultaneous macOS, Windows,
and Linux releases.

* **Documentation**
* Updated Git Flow and release process documentation to reflect new
automated workflows.

* **Tests**
  * Added tests for automated version management.

* **Chores**
  * Refined release workflows for improved efficiency and reliability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: tomymaritano

.github/workflows/auto-tag.yml

@@ -0,0 +1,164 @@
+name: Build & Publish
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+env:
+  NODE_VERSION: '22'
+  ELECTRON_CACHE: ~/.cache/electron
+  ELECTRON_BUILDER_CACHE: ~/.cache/electron-builder
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-14
+            platform: mac
+          - os: windows-latest
+            platform: win
+          - os: ubuntu-latest
+            platform: linux
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'pnpm'
+
+      - name: Cache pnpm store
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ matrix.platform }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: pnpm-${{ matrix.platform }}-
+
+      - name: Cache Electron downloads
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ env.ELECTRON_CACHE }}
+            ${{ env.ELECTRON_BUILDER_CACHE }}
+          key: electron-${{ matrix.platform }}-${{ hashFiles('apps/desktop/package.json') }}
+          restore-keys: electron-${{ matrix.platform }}-
+
+      - name: Force HTTPS for GitHub git dependencies
+        shell: bash
+        run: git config --global 'url.https://github.com/.insteadOf' 'git@github.com:'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build packages
+        run: pnpm build
+
+      - name: Build Electron app
+        working-directory: apps/desktop
+        run: pnpm build
+
+      - name: Build distributables (macOS)
+        if: matrix.platform == 'mac'
+        working-directory: apps/desktop
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: pnpm dist:mac --publish always
+
+      - name: Build distributables (Windows)
+        if: matrix.platform == 'win'
+        working-directory: apps/desktop
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: pnpm dist:win --publish always
+
+      - name: Build distributables (Linux)
+        if: matrix.platform == 'linux'
+        working-directory: apps/desktop
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+        run: pnpm dist:linux --publish always
+
+      - name: Upload artifacts (backup)
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.platform }}-build
+          path: |
+            apps/desktop/release/*.dmg
+            apps/desktop/release/*.zip
+            apps/desktop/release/*.exe
+            apps/desktop/release/*.AppImage
+            apps/desktop/release/*.deb
+            apps/desktop/release/latest*.yml
+            apps/desktop/release/*.blockmap
+          if-no-files-found: ignore
+          retention-days: 30
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: gh release edit "$TAG_NAME" --draft=false --repo "${{ github.repository }}"
+
+  tweet:
+    needs: publish
+    runs-on: ubuntu-latest
+    if: "!contains(github.ref_name, 'beta')"
+    continue-on-error: true
+    steps:
+      - name: Extract version
+        id: version
+        run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+
+      - name: Post tweet
+        uses: dart-actions/tweet@v1
+        with:
+          consumer-key: ${{ secrets.TWITTER_API_KEY }}
+          consumer-secret: ${{ secrets.TWITTER_API_SECRET }}
+          access-token: ${{ secrets.TWITTER_ACCESS_TOKEN }}
+          access-token-secret: ${{ secrets.TWITTER_ACCESS_SECRET }}
+          text: |
+            Readied ${{ steps.version.outputs.tag }} is out!
+
+            https://github.com/${{ github.repository }}/releases/tag/${{ steps.version.outputs.tag }}
+            #readied #markdown #devtools
+
+  sync-develop:
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create sync PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr create \
+            --base develop \
+            --head main \
+            --title "chore: sync release ${{ github.ref_name }} back to develop" \
+            --body "Auto sync of release commit and changelog." \
+            --repo "${{ github.repository }}"