chore: adopt changesets

[pikonha]

Summary

This PR adopts Changesets as the canonical versioning, changelog, tagging, and GitHub Releases workflow for the notification-system monorepo.

It keeps the existing Railway deploy flow untouched. Deploys still happen from dev and main; this PR only adds a durable release record around those deploys.

What changed

• Added Changesets configuration under .changeset/ with independent package versioning, GitHub changelog formatting, baseBranch: dev, and updateInternalDependencies: patch.
• Added @changesets/cli and @changesets/changelog-github to the root dev dependencies, plus a pnpm changeset script alias.
• Marked every workspace package as private: true so no npm publish can happen accidentally.
• Added an empty bootstrap changeset so this setup PR does not bump package versions.
• Added version.yaml to open/update the rolling “Version Packages” PR on pushes to dev.
• Added release.yaml to create package git tags and GitHub Releases on pushes to main, without publishing to npm.
• Added release-readiness.yaml to block dev -> main PRs while unconsumed changesets still exist.
• Added graphql-contract-updates.yaml to require changesets for anticapture-client and all generated-client consumers when GraphQL contract files change.
• Extended test.yaml with a changeset-check job so PRs to dev must include a changeset unless they are doc/GitHub/config-only changes.
• Added CLAUDE.md documenting how contributors and agents should use the new workflow.

GitHub setup required

Before relying on this workflow, confirm these repository settings in GitHub:

1. Go to Settings -> Actions -> General -> Workflow permissions.

   • Select Read and write permissions.
   • Enable Allow GitHub Actions to create and approve pull requests.
   • This is required for changesets/action@v1 in version.yaml to open/update the Version Packages PR.

2. Confirm branch protections for dev allow the GitHub Actions bot to create/update the Version Packages PR branch.

   • The workflow commits to a generated branch and opens a PR back to dev.
   • If repository rules restrict branch creation, add an exception for GitHub Actions / github-actions[bot] or otherwise allow the Changesets action branch pattern used by the action.

3. Confirm branch protections for main allow release.yaml to create tags and GitHub Releases on push to main.

   • The workflow needs contents: write, already declared in the workflow.
   • No npm token is needed because this workflow uses pnpm changeset tag, not pnpm changeset publish.

4. After this PR merges, make the new checks required where appropriate:

   • On PRs to dev: require changeset-check and graphql-contract-updates.
   • On PRs to main: require release-readiness.
   • Keep the existing service test matrix requirements as-is.

5. Keep Railway deploy settings unchanged.

   • .github/workflows/deploy.yaml was intentionally not edited.
   • dev and main deploys continue independently of Changesets.

Expected release flow after merge

1. Feature PRs target dev and include a .changeset/*.md file, or an empty changeset for non-releaseable changes.
2. On push to dev, version.yaml opens or updates the rolling “Version Packages” PR.
3. Merge the Version Packages PR into dev before opening the weekly dev -> main PR.
4. release-readiness.yaml blocks the dev -> main PR if any unconsumed changesets remain.
5. On push to main, release.yaml creates package tags and GitHub Releases. Nothing publishes to npm.

Validation

• pnpm install --frozen-lockfile
• pnpm changeset status
• pnpm changeset status --since=origin/dev after staging
• JSON parsing for Changesets config and all edited package manifests
• Ruby YAML parsing for all .github/workflows/*.yaml
• Verified all 10 package manifests have private: true
• pnpm build
• pnpm dispatcher test
• pnpm logic-system test
• pnpm consumer test
• pnpm subscription-server test
• pnpm --filter @notification-system/messages test
• pnpm --filter @notification-system/anticapture-client test
• pnpm --filter @notification-system/dashboard test

Known local test limitation

pnpm test was also run. It failed only in @notification-system/integrated-tests during Jest global setup because this local machine does not have a working Testcontainers container runtime. The package-specific CI matrix tests pass locally.

[vercel]

@pikonha is attempting to deploy a commit to the Blockful Team on Vercel.

A member of the Team first needs to authorize it.