Placeholder versions (0.0.0-dev) + in-runner stamping — zero release churn

[MelbourneDeveloper]

TLDR

Bring the release pipeline into conformity with Shipwright [SWR-VERSION-BUILD-STAMPING]: source version: fields become 0.0.0-dev placeholders and the real version is stamped from the tag in the CI runner working tree only — never committed, pushed, branched, or PR'd back. Releases now produce zero churn on tracked source.

What Was Changed?

• Placeholders everywhere: every packages/*/pubspec.yaml version: → 0.0.0-dev (the 9 were at 0.11.0-beta; dart_node_sql_js was hard-coded at the release version 0.13.0-beta).
• In-runner stamping, no churn: publish-tier1/2/3.yml now run dart run tools/prepare_publish.dart <version> in a throwaway runner and publish directly. This removes:
  • the release/<version> branch,
  • the bot commits (chore: prepare release …, chore: switch to local dependencies after publish — the latter was 17a0abcf),
  • the "Create PR to main" step (a PR that bumps a placeholder to a real version — the spec says such PRs MUST be rejected).
• Least privilege: dropped contents: write / pull-requests: write from tier1 and contents: write from tier3 ([SWR-SEC]) — the jobs no longer write to the repo.
• Docs: documented the placeholder contract in CLAUDE.md (new Releases rule) and the release skill; removed the stale "merge the release PR" / manual switch_deps steps.

Why

The previous flow stamped versions onto a release branch and opened a PR that bumped committed versions on main (PR #61), and tier3 committed a dep-switch back — all of which is source churn the contract forbids. [SWR-VERSION-BUILD-STAMPING]: "All version fields in source … MUST be 0.0.0-dev on every branch at all times" and "Release jobs MUST NOT commit, push, or move source-control refs after the tag exists."

How Do The Automated Tests Prove It Works?

• Round-trip verified locally: prepare_publish.dart 0.99.0-test stamps 0.0.0-dev → 0.99.0-test and rewrites every internal path: dep to ^0.99.0-test; git restore packages returns the tree to 0.0.0-dev + path: deps. So CI can stamp at publish without any committed change.
• dart pub get resolves cleanly with 0.0.0-dev path deps (versions are ignored for path sources).
• Existing CI (Lint/Test/Build/Website) runs unchanged — package versions don't affect analyze/tests; the publishable packages remain 100%-covered.

Breaking Changes

• None for consumers. Internal release-process change only: no more release branch or release PR; the already-published 0.13.0-beta packages are unaffected. Next release stamps from its tag.