fix(release): the next cut annotates what the last one shipped unlisted, instead of refusing the queue

Withdraws the merge-queue refusal. main takes a changeset-bearing landing
about every twenty minutes (77 of 111 landings in a day), so a Version
Packages PR almost never reaches the queue current, and refusing it would
block nearly every release to protect a CHANGELOG line.

`release-pending-publish.mjs annotate-shipped` runs first in the root
`version` script (joined with `;`, so it cannot stop the pass). It finds the
last version commit, takes the changesets that sat unconsumed in its tree,
and gives each one still pending the lead line
`**Shipped in VERSION**, whose CHANGELOG missed this entry; listed here one
prerelease late.` -- frontmatter byte-unchanged, idempotent (a body already
led by `**Shipped in` is left as it is), and only when VERSION is on npm. A
shallow clone is deepened in bounded rounds; anything it cannot decide is a
::warning:: with nothing written, and it exits 0 on every path.

The queue-guard mode, its batteries and the lint.yml step are removed;
lint.yml is back to its merge-base bytes. Self-test: 112 cases across 28
batteries.

Claude-Session: https://claude.ai/code/session_016PVjjuVPte5XEJvaQx1E4t
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.github/workflows/lint.yml

@@ -3328,28 +3328,6 @@ jobs:
         continue-on-error: true
         run: node scripts/release-pending-publish.mjs --self-test
 
-      # The merge-queue guard on the same release path (#23818). A Version
-      # Packages PR cut from a base that main has since passed by a changeset
-      # lands a version commit whose CHANGELOG leaves that changeset out, and
-      # the merge-queue build is the one CI run that sees the tree it lands.
-      # So `queue-guard` judges it here, and exits 1 when a version commit in
-      # the group's base..head would land a changeset it did not consume.
-      # On any other event it prints "not a merge-queue build" and exits 0,
-      # and a build that moves no version is never judged, so no ordinary PR
-      # depends on it. Base and head are the payload's full shas, never a ref
-      # guess, and they render empty on every other event. The checkout's
-      # `fetch-depth: 0` is what makes the base resolvable; the guard refuses a
-      # shallow clone outright rather than answering from a graft boundary.
-      # Rationale: `scripts/release-pending-publish.mjs` header, `queue-guard`.
-      - name: Version Packages PR lands no changeset behind main
-        id: version-packages-pr-lands-no-changeset-behind-main
-        continue-on-error: true
-        env:
-          OS_GATE_EVENT_NAME: ${{ github.event_name }}
-          OS_GATE_MERGE_GROUP_BASE_SHA: ${{ github.event.merge_group.base_sha }}
-          OS_GATE_MERGE_GROUP_HEAD_SHA: ${{ github.event.merge_group.head_sha }}
-        run: node scripts/release-pending-publish.mjs queue-guard --event "$OS_GATE_EVENT_NAME" --base "$OS_GATE_MERGE_GROUP_BASE_SHA" --head "$OS_GATE_MERGE_GROUP_HEAD_SHA"
-
       # #3825 Node-version drift guard: a runtime pin is 18 separate string
       # literals across .github/workflows, so a split is invisible until someone
       # greps for it. One did open — every PR gate sat on Node 20 (EOL

package.json

@@ -17,7 +17,7 @@
     "setup": "pnpm install && pnpm --filter @objectstack/spec build",
     "prepare": "node scripts/setup-git-hooks.mjs",
     "check:merge-driver": "node scripts/git-env.mjs --self-test && node scripts/git-merge-regen.mjs --self-test && node scripts/check-regen-pending.mjs --self-test",
-    "version": "changeset version && node scripts/sync-protocol-version.mjs && node scripts/sync-template-versions.mjs && node scripts/sync-docs-image-tags.mjs && node scripts/sync-release-index-currency.mjs && node scripts/check-skill-compatibility-version.mjs --fix",
+    "version": "node scripts/release-pending-publish.mjs annotate-shipped; changeset version && node scripts/sync-protocol-version.mjs && node scripts/sync-template-versions.mjs && node scripts/sync-docs-image-tags.mjs && node scripts/sync-release-index-currency.mjs && node scripts/check-skill-compatibility-version.mjs --fix",
     "release": "pnpm run build && bash scripts/build-console.sh && bash scripts/release-publish.sh",
     "docs:dev": "pnpm --filter @objectstack/docs dev",
     "docs:build": "pnpm --filter @objectstack/docs build",