Keep Changesets version PR updates signed and append-only

[kvz]

Why

The organization requires signed commits and rejects non-fast-forward branch updates. Changesets'
current version-PR updater force-resets its branch, so later version updates can get stuck. Deleting
the old branch unblocks one release, but does not fix the next update.

#509 has already merged and published successfully. This PR fixes future version-PR preparation;
it does not republish packages or change the Changesets publishing path.

Changes

• Generate versions from the exact current main SHA with the existing Changesets command.
• Restore only the previous generated deltas, merge main through GitHub, then append the newly
  generated tree through the signed, exact-head commit API. This preserves history and file modes,
  consumes newly added changesets correctly, and avoids generated-file merge conflicts.
• Refuse unexpected source edits or concurrent branch changes. No force pushes, branch deletion,
  additional credentials, or weaker repository rules.
• Serialize release runs with GitHub's queue: max (up to 100 pending runs), so a newer feature
  merge cannot displace a waiting publication. Skip superseded versioning runs without publishing.
• Preserve the existing publisher, trusted publishing, and Viewer alpha policy. No runtime package
  change or changeset is needed.

Validation

• Red-first regression tests for trailing newlines, history/changeset consumption, file modes,
  conflicting generated files, concurrent edits, and superseded runs; 24 focused tests pass.
• yarn check passes. Explicit strict TypeScript checking also covers the new scripts.
• A real Git object fixture reproduces the broken squash/lockfile cases, then proves the corrected
  final tree preserves exact bytes, executable files, symlinks, and consumed changesets.
• A temporary remote branch proved GitHub produces a verified two-parent merge under the existing
  organization rules. The branch was deleted after recording the result; no release branch or
  protection setting was changed.
• Council review findings were reproduced and addressed. Exact-head CI is green at eea4a06: all 11 checks pass, including the release dry run, packed Next browser fixture and Supabase Edge fixture.

Separate production canary

Content #6103's private checklist records the separate production canary. Published-package smoke:
Node/legacy 4.14.0 and Viewer 0.0.2;
both published SDK names pass the Supabase Edge gate with zero native image dependencies.
Production upload, metadata, version reads, receipt recovery and catalog sync work for ordinary
images. The follow-up production browser proof
passes public/private CDN delivery, cookie authorization and opaque/alpha placeholder handling.
Its one temporary Smart CDN key and exact test-prefix publication were revoked; existing key
policies and public-prefix settings are verified unchanged. The remaining tiny-image color gate
needs deployment of API2 #9191: the inspected workers still run an older build. No deployment was
performed here.

Refs #509, #511 and transloadit/api2#9191.