ci: release weekly from git history with git-cliff instead of release-please

[panz3r]

Same release setup as qrcodets and react-native-toolbox (already released qrcodets v1.0.1 and react-native-toolbox v6.0.5 this way), adapted to the monorepo with one matrix job per plugin. It replaces release-please, whose release PRs are pushed with GITHUB_TOKEN and never get the required CI checks.

How it works (release.yml, Tuesdays 17:00 UTC + manual)

For each plugin (gulp-browser-sync, gulp-sharp):

1. git-cliff (orhun/git-cliff-action v4.9.1, pinned) computes the next version and release notes from conventional commits that touch plugins/<name>/**, since the last <name>-vX.Y.Z tag (same tag format as release-please).
2. If nothing is releasable (no notes, or the tag already exists) the job stops.
3. Otherwise: pnpm/setup (pnpm + Node.js latest), build the plugin, pnpm version --no-git-tag-version, pnpm publish --publish-wait-timeout 600000 (npm trusted publishing via OIDC; also replaces catalog: specifiers with real ranges in the published manifest), then gh release create <name>-vX.Y.Z titled <name>: vX.Y.Z with the generated notes. Nothing is committed back to main.
4. A published version is skipped on rerun, so a failed run can be retried safely.
5. Manual runs accept dry-run: true: compute versions and notes (job summary), build, and run pnpm publish --dry-run.

Release rules (cliff.toml)

• feat → minor, ! / BREAKING CHANGE → major, everything else → patch.
• feat, fix, perf, refactor, docs and chore are included in the release notes; ci, build, test, style are skipped.
• Only changes inside the plugin folder count; root changes (lockfile, catalog, CI) do not cut releases.

Other changes

• Remove release-please-config.json and .release-please-manifest.json.
• Plugin CHANGELOG.md files are frozen with a pointer to GitHub Releases (filtered per plugin); the READMEs link there too.
• package.json versions in the repo are no longer bumped; the published package gets the right version at publish time.

Verification

Dry run on this branch: run 36636840034. Because the branch has a separate docs: commit touching both plugins, both jobs computed a release (gulp-browser-sync-v1.0.2, gulp-sharp-v1.0.4), built, and stopped at Skip publishing ... (dry run).

After squash-merge only the ci: title lands on main, so nothing is releasable yet (no plugin changes since gulp-sharp-v1.0.3 / gulp-browser-sync-v1.0.1); the first real release will happen with the next plugin change.