build(release): call the reusable release workflow with the inputs it now requires

[systemfsoftware-maker]

Summary

Every Release run since 65155c7 failed at startup, and before that the version job failed with VersionIntentMalformed: path=package.json. So nothing after 17.0.2 shipped, including #225-#228. This PR fixes both on our side. pnpm-release-management is unchanged.

• Caller (release.yml): drops tools-ref, which the reusable release.yml@main no longer declares. Passes the now-required ci-workflow: ci.yml and grants actions: write, which the reusable needs to dispatch CI on the release PR branch.
• ci.yml: accepts workflow_dispatch, so that dispatch has something to run.
• Root package.json: gets "version": "0.0.0". With the changesets strategy, version-management reads the root manifest through ROOT_TARGET (apps/version-management/src/boundary.ts targetsOf). bump.ts then calls surfaces.readSurface on it unconditionally, before branching on strategy. The root is private and not a workspace member: pnpm-workspace.yaml packages: lists only test/*, packages/*, packages/toolchain/*, packages/ignorers/* and packages/frameworks/*. That means it is never packed into workspace-tarballs and never tagged. Its name stryker-js-effect cannot collide with any @systemfsoftware/* member tag. Under changesets, writeChangesets writes only cargo surfaces and member changelogs, so 0.0.0 stays put on every release.
• flake.nix: the default dev shell includes the pinned pnpm-release-management release-tools. The reusable runs nix develop --command version-management … and github-release-management …, and before this change those binaries were not in our shell (version-management: not found, exit 127).
• .changeset/changelogs/.gitkeep: version-management bump writes each member's section into changelogDir (.changeset/changelogs) and does not create the directory. build(release): publish per-package workspace tarballs from the flake #196 left that directory empty, so git dropped it. With only the fixes above, bump exited 1. Adding this commit was the only change, and the next run exited 0.

flake.lock is unchanged. The pinned pnpm-release-management 603ecb49 already includes the changesets rename (ca932ae, #33) and the --tarballs plan. The commits on its main after the pin don't matter here: #34 (aaba9ed) only affects workspaces with no public package, and we have public packages.

Evidence

a. version-management bump, run in throwaway checkouts and discarded afterwards:

Before, on origin/main f06f244fa, using the pinned release-tools:

$ version-management bump
::error::VersionIntentMalformed: path=package.json
exit=1

(With plain nix develop on main: version-management: not found, exit 127.)

After, on this branch 2e9cc4ff4:

$ nix develop --command version-management bump
versioned packages
exit=0
 38 files changed, 18 insertions(+), 179 deletions(-)

It consumed all 20 pending intents. Member versions moved:

Package	From	To
@systemfsoftware/stryker-js	17.0.2	18.0.0
stryker-js-plugin-interface	14.0.0	15.0.0
stryker-js-vitest-runner	8.1.1	9.0.0
stryker-js-typescript-checker	8.2.1	8.3.0
stryker-js-cli-contract	0.3.1	0.4.0
13 others		patch

It also wrote 18 .changeset/changelogs/<pkg>@<v>.md files. It printed 38 must depend on the current version … vs catalog:stryker notices. Those are the intended catalog:stryker dogfood pins (AGENTS.md START-6) and do not fail the command.

b. Plan phase: nix build .#workspace-tarballs exits 0 and contains 17 tarballs plus index.json. Then:

$ github-release-management plan --tarballs <out> --output <file>
plan-release: pending_intents=20 this_cycle=0 deferred=0 -> phase=version
exit=0

c. Workflow lint: actionlint 1.7.12, pinned through the flake's nixpkgs, exits 0 on release.yml and ci.yml. The repo has no workflow lint of its own.

d. CI: green on the head (see checks).

Local gates: format:check, lint:conventions, guard:projects and nix flake check all pass. No publishable package changed, so no changeset is needed.

Known gap, outside this repo

Under the repo's versioning.changelog.storage: repository (#196), the release PR that bump produces will fail guard:projects (CHANGELOG-SECTIONS): 35 errors. The bump run above shows why. ChangelogStoreLive.writeMemberChangelog (pnpm-release-management packages/workspace-adapter) always writes a parked changelogDir/<pkg>@<v>.md file. It never writes the section into the package's CHANGELOG.md. Meanwhile github-release-engine/cycle.ts reads ${member.dir}/CHANGELOG.md under repository. Both sides belong to pnpm-release-management, so this PR does not touch them.

Nothing was run with stryker.

Verdict-Semantics: unchanged

[kiro-systemf]

Verified: CI 11/11 green on 2e9cc4f, before/after bump + plan evidence, root 0.0.0 not a workspace member.