Simplify Changesets releases and handle registry visibility delays

[kvz]

Why

The generated Changesets branch now has a narrow force-update exemption, so the custom append-only version-PR writer is no longer needed. npm also accepted Viewer 0.0.3 before it became visible in package metadata, causing an unnecessary second publication attempt.

Changes

• Use the pinned standard Changesets action for versioning, retaining GitHub-verified commits, OIDC, FIFO publication runs, and the existing lockfile/version command.
• Keep a small stale-main guard: an old versioning run cannot replace a newer release PR, but a queued publication still runs after main advances.
• Wait up to ten minutes for the exact accepted Viewer version to appear before invoking Changesets. Preserve the alpha tag and single tag-discovery pass; fail closed on lookup errors and never republish in response to a visibility timeout.
• Delete the custom 258-line writer and its 363-line implementation tests; update recovery instructions.

Verification

• Regressions reproduced before fixes; publisher/guard suites: 19/19.
• yarn check, yarn install --immutable, and git diff --check pass.
• Council review completed; both findings fixed red-first (stale runs and outdated guidance).
• No package version changes, real npm publishes, tag changes, credential changes, or broad branch-rule changes.
• Progress/evidence: docs/prompts/2026-09-25-release-tidy.md.

After merge, monitor the main release workflow. Do not introduce a dummy package bump to test publication.

[kvz]

Squash/admin merged as 64da2ff after all 11 PR checks passed and council findings were fixed red-first. Main Release run 36178945238 passed: standard Changesets action ran the alpha-aware publisher, correctly found the exact package versions already published, and did not republish or change tags. Main CI is still being monitored separately.