fix(*): prepare next workflow and release safeguards

[omermorad]

Summary

• Require reviewed, squash-only PRs to next with Conventional Commit titles and workspace package scopes, checked by amannn/action-semantic-pull-request.
• Rulesets are applied directly in GitHub settings. No checked-in ruleset JSON, helper scripts, or custom package-verification action.
• Support Node 22+, align MIT and canonical repository metadata, and document supported versus planned features.
• Repair CI, reject unsupported governance modes, and preserve changesets on invalid contract references.
• Gate release workflows behind the release environment and explicit approval, with native npm/jq authorization and metadata checks.

Validation

• Build and lint passed; 3 unit tests passed.
• 323 E2E tests passed, 1 skipped.
• Semantic PR Action passed on the previous revision; checks rerun after this cleanup.
• Remaining workflow YAML parses and documentation links resolve. No workflow references the deleted action.

Follow-up

Security remediation is in #18, stacked on this PR and also targeting next. Merge this PR first. The historical next-to-master PR is not required for this workflow.

Nothing was tagged or published. Explicit approval from Omer is still required before tagging or publishing.