docs: contribution policy — CONTRIBUTING, PR template, changelog CI guards

[Anarchid]

Problem

chronicle has no CONTRIBUTING.md, no PR template, and no changelog — and no
mechanism that would notice. Consumers of @animalabs/chronicle currently
learn what a release contains by reading git log, and the only GitHub
"release" this repo has ever had is a stale v0.2.0 draft.

That matters more here than elsewhere in the ecosystem: this is the
persistence layer, so the changes people most need warned about are on-disk
and wire-format ones. 0.3.0 shipped a forward-only state_update encoding
change on 2026-08-01 — correct, deliberate, well-tested, and announced
nowhere a consumer would look.

The mechanism has to bind direct pushes, not just PRs. Across the ecosystem
52–85% of commits on main arrive by direct push, and version bumps are
release-time maintainer actions by construction — so a PR-side check alone
would miss exactly the commits that cut releases. This is the third rollout
of the same policy, after connectome-host #49 and context-manager #51.

Changes

Ported from those two, adapted to this repo (Rust + napi, cargo test
caveats, format-compatibility framing):

• CONTRIBUTING.md — codifies existing practice rather than aspiration:
  merge commits only, comment-based review with run-the-branch transcripts,
  evidence-over-assertion test reporting, and AI attribution as the norm.
  Explicitly binds direct pushes and PRs, human and AI authors, identically.
• .github/PULL_REQUEST_TEMPLATE.md — Problem / Changes / Tests /
  Compatibility / Not verified, plus a changelog checkbox.
• .github/workflows/changelog.yml — soft PR check: touching src/
  without CHANGELOG.md fails, with a no-changelog label opt-out (label
  created).
• publish.yml — two additions. The publish job is now gated on the ref
  rather than the event, so a manual dispatch against a branch can no
  longer publish whatever version package.json happens to carry; and a tag
  with no matching ## X.Y.Z changelog section fails the release. A new
  github-release job mirrors the tag's section into GitHub release notes,
  deliberately independent of the npm publish job and its cross-build matrix
  — some consumers run github-clone checkouts, so notes must exist even when
  the native build or publish fails.
• scripts/release-changelog.mjs + a version hook in package.json —
  npm version <level> cuts Unreleased into ## X.Y.Z — YYYY-MM-DD
  pre-tag, so the tag and tarball carry it. Refuses an empty Unreleased, a
  duplicate section, and more than one Unreleased heading (a second one
  silently strands entries).
• CHANGELOG.md, watermarked at 0.2.7, with 0.3.0 written up in full.

That last point is the deliberate one. The earliest policy PRs held that the
enforcement PR should itself conform, and this branch was cut on 2026-07-27 —
before 0.3.0 tagged. Landing an empty changelog would mean shipping a file
that is already behind main, with the one release it exists to describe
missing. The 0.3.0 entries are reconstructed from the ten commits in
v0.2.7..v0.3.0; the MessagePack encoding change is filed as
### Breaking (on-disk format) with the who-acts / migration / unchanged
shape the policy asks for, because "existing stores still open, but a store
written by 0.3.0 cannot be read by older chronicle" is the first thing any
reader of this package's changelog wants stated.

Tests

No src/ changes, so the Rust suite is untouched and was not run — this is
docs, CI config, and one npm lifecycle hook. What was exercised is the
tooling this branch adds, against the real CHANGELOG.md:

• publish.yml tag guard, simulated for v0.3.0: section found, exit 0.
• github-release extraction, same awk as the workflow: 107 lines /
  6,646 bytes, starting at ### Breaking (on-disk format) and ending on the
  section's last line — no bleed into neighbouring sections.
• scripts/release-changelog.mjs against a copy, package.json at
  0.3.1:
  • empty Unreleased → '## Unreleased' has no entries — nothing to release as 0.3.1., exit 1
  • one entry added → cut Unreleased into '## 0.3.1 — 2026-08-07'.,
    exit 0, with a fresh empty Unreleased left above it
  • re-run → a '## 0.3.1' section already exists., exit 1
• Unreleased heading count: exactly 1.
• All three workflow files parse as YAML.

Compatibility

No format change — no Rust source is touched. The only runtime-adjacent edit
is the version script in package.json, which runs during npm version
and not during install, build or publish.

Not verified

• The changelog.yml check has not run yet — this PR touches no src/
  files, so it will pass trivially rather than exercising the failure path.
  The equivalent workflow was verified live on connectome-host #49.
• The tag guard and github-release job cannot run until the next release;
  they stay unexercised on real infrastructure until then, as they did on
  the previous two rollouts. The next npm version <level> && git push --follow-tags will be this repo's first non-draft GitHub release.
• 0.3.0's changelog entries are reconstructed from commit messages and the
  measurements quoted in them, not re-measured. The performance numbers are
  as their authors reported them.
• No store was opened and no native module was built for this branch.

---

• CHANGELOG.md updated under ## Unreleased — or this change is
  internal-only / test-only / docs-only (apply the no-changelog label).

Docs-only by the letter of the check, but the file ships with 0.3.0 written
up rather than empty, per the self-conformance point above.

🤖 Generated with Claude Code