ci: release with sem instead of legacy semantic-release

[spacedevin]

Every other repo that cuts releases this way runs tishlang/sem; deck was the odd one out, still on semantic-release with the whole prerelease flow written by hand.

The git workflow is unchanged — a green main cuts a prerelease carrying the tarballs, and promoting it fires npm-release.yml and crates-release.yml. Only the machinery moves.

What this deletes

Most of the value. The old release job hand-rolled:

• a release/vX branch, force-pushed each run
• a changelog built by git log against the last tag
• raw curl calls to the releases API, including a "422 means it already exists, go fetch its id and PATCH it" retry path
• two more curls to upload the tarballs as assets

@sem/github does all of that, so ~190 lines of workflow collapse into plugin config. Net: 288 lines changed in ci.yml, and package-lock.json sheds ~6,300 lines as the semantic-release toolchain leaves devDependencies (the action carries its own).

Two things carried over from chuggie-engine, because they aren't obvious

• git identity is configured before sem runs. A tag is a commit-shaped object and actions/checkout sets none, so sem fails with Committer identity unknown. That exact failure is why chuggie-engine had zero releases for months despite green builds.
• issues: write — @sem/github opens an issue when a release throws, and without the permission the real error is buried under a 403 from the issues API.

Licence gate

I also brought over that repo's licence gate — which was written about this repo:

crates.io has no delete — only yank — and npm unpublish is a 72-hour window, so an artifact published under the wrong licence is effectively permanent. (This is not hypothetical: @spacedevin/deck shipped two versions under the wrong licence and both had to be yanked.)

It now refuses to build an artifact unless both LICENSE and packages/player/LICENSE are present. The second of those only started existing in #18 — before that the player tarball asserted a licence it didn't ship.

Config

.releaserc.json → .semrc.json, @semantic-release/* → @sem/*. The two-package lockstep packing is unchanged: same version on both, player's dependency stamped to ^<version> before packing.

Verification

npm ci from a clean node_modules succeeds without the semantic-release packages, and npm test is green (100% coverage, 13 conformance cases, 14 example blocks, Tish VM suite, JS smoke). Both inline sem configs and the workflow itself parse as YAML, with release still gated on [test, rust_crate, release_check].

The release path itself can only really be exercised on a main push — worth watching the first run after merge.