ci: release with semantic-release from main and next

[timonwong]

Summary

Replace the hand-bumped version + pushed v* tag with semantic-release. A push to main publishes to the latest dist-tag; a push to next publishes x.y.z-next.n to the next dist-tag with a prerelease GitHub Release.

Changes

• release.config.js: branches main and next (prerelease). conventionalcommits preset, because the default angular preset ignores feat!:. A breaking change is a minor bump while the package is 0.x (semantic-release would otherwise jump to 1.0.0).
• release.yml: runs on push to main/next. It calls ci.yml (now workflow_call), then runs semantic-release, which publishes through Trusted Publishing (OIDC, @semantic-release/npm 13) and uploads shellcheck.wasm, .sha256 and build-info.json. The workflow file name stays release.yml, so the npm-side Trusted Publisher config does not change.
• ci.yml: no longer runs on push to main, because release.yml runs it there. It only cancels in-progress runs for PRs.
• package.json: version is 0.0.0-semantic-release and is never committed back. publishConfig.provenance: true.
• conventional-changelog-conventionalcommits is pinned to ^9. v10 needs conventional-changelog-writer@9, and release-notes-generator 14 still ships writer 8, so v10 fails at notes generation.
• bump-shellcheck.yml: PR title chore(wasm) → feat(wasm), so that merging a ShellCheck bump cuts a release.
• AGENTS.md / README: release process.

Before merging

1. Merging this PR into main publishes 0.2.0 to latest. The analyzer sees the feat!/feat commits since v0.1.1. If that is not wanted yet, create next from main and merge this PR there first.
2. One-time migration: attach channel notes to the existing prerelease tags. Without them, next computes 0.2.0-next.1 and collides with the existing tag.

   for t in v0.2.0-next.0 v0.2.0-next.1; do
     git notes --ref "semantic-release-$t" add -f -m '{"channels":["next"]}' "$t^{commit}"
     git push origin "refs/notes/semantic-release-$t"
   done

   The notes must go on the commit (^{commit}), not on the annotated tag object. semantic-release reads them with git log %N.
3. Create the next branch on the remote.

Dry-run evidence

This is semantic-release --dry-run with this release.config.js (analyzer + notes plugins), run against a local mirror of the real tag history:

Branch	Notes on old prerelease tags	Result
main	–	0.2.0 (last v0.1.1)
next	no	0.2.0-next.1 ← collides
next	yes	no release (only chore/ci since v0.2.0-next.1)
next + fix:	yes	0.2.0-next.2 (last v0.2.0-next.1)

The first 0.2.0 notes will contain a noisy BREAKING CHANGES section, because the squash body of #21 contains BREAKING CHANGE: footers from its sub-commits. Edit the GitHub Release by hand if that matters.

[timonwong]

@felipecrs I'm merging this now, in order to experiment this shellcheck-wasm package

[github-actions]

🎉 This PR is included in version 0.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀