feat: add semantic-release with conventional commits

[joris974]

Summary

• Add semantic-release configuration (.releaserc.yaml) with conventionalcommits preset, NPM publish, and GitHub release plugins
• Add release.yml workflow using cycjimmy/semantic-release-action@v6.0.0
• Support rc/* branches for pre-releases
• Add RELEASE.md with conventional commit instructions
• Add release section to README.md
• Uses pnpm for build command in .releaserc.yaml (matching this repo's package manager)

Prerequisites

Before merging, ensure:

• NPM_TOKEN secret is configured on the repo for NPM publishing
• Repository rulesets have a bypass configured for the release bot (if applicable)

Test plan

• Verify YAML syntax is valid for .releaserc.yaml and release.yml
• Confirm CI workflow passes on this PR
• After merge, verify a release is triggered with the feat: commit prefix
• Test pre-release flow by pushing to an rc/* branch

Mirrors freckle/i18n-scripts-js#21

[jleichty-ren]

this looks like the same release setup as freckle/cancelable-promise-js#152, so the main concerns were:

• the release config calls pnpm install && pnpm run build, but the release workflow doesn’t set up pnpm first
• @semantic-release/git runs before @semantic-release/npm, so i’m not sure the bumped package.json would get committed back
• if we do want to commit back to main, ${{ github.token }} may not be the right token for the repo ruleset
• it may be worth adding "files": ["dist"] before automated publishing

[cdmren]

I'm very unfamiliar with most of this but tried to vibe this to completion because I would like to have tags so we can update this library.

Pushed a follow-up commit addressing each point:

• pnpm/action-setup + actions/setup-node (with pnpm cache) now run before the semantic-release action, so the prepareCmd has pnpm on PATH.
• Dropped the @semantic-release/git step entirely rather than trying to get the ordering right. dist and package.json are no longer committed back to main — the release job builds dist fresh each run and npm packs whatever's on disk via the new files allowlist. That also sidesteps the token/ruleset question, since the workflow no longer pushes to a protected branch at all; it only publishes to npm and creates a GitHub release/tag.
• Added "files": ["dist"] to package.json. Verified with npm pack --dry-run that the tarball now only contains dist/, package.json, LICENSE, and README.md (previously it would have packed the whole repo, including src, workflows, and config).

Also rebased onto current main since the branch was ~54 commits behind. Confirmed NPM_TOKEN is available to this repo as an org-level secret, and the release workflow no longer needs the ruleset bypass since it doesn't push to main.

This mirrors the setup now live on freckle/cancelable-promise-js.

—by Claude

[jleichty-ren]

lgtm, thanks for picking this back up!