ci: release with release-please instead of Changesets

[Nsttt]

Summary

Moves @module-federation/tanstack releases from Changesets to release-please. From now on the squash-merged PR title (already enforced by Validate PR title) decides the release: fix: → patch, feat: → minor, breaking → minor while below 1.0.

How a release works after this lands

1. Every push to main runs the new Release Please workflow, which opens or updates a chore: release <version> PR. That PR bumps packages/tanstack/package.json, .release-please-manifest.json, and packages/tanstack/CHANGELOG.md.
2. Merging it tags the merge commit (0.1.1, no v, no component, same scheme as the existing 0.1.0 tag) and publishes a GitHub Release.
3. That release: published event triggers the existing release.yml, which validates tag = package version, reruns the gate, and publishes through npm trusted publishing. release.yml keeps its filename and Publish environment, so the npm trusted-publisher config stays valid.

release-please authenticates with REPO_SCOPED_TOKEN, the secret the old Release Pull Request workflow already required. This matters: a release created with the default GITHUB_TOKEN would not trigger release.yml.

Changes

• Adds release-please-config.json, .release-please-manifest.json (seeded at the published 0.1.0), and .github/workflows/release-please.yml (pinned googleapis/release-please-action v5.0.0).
• Removes .changeset/, @changesets/cli, the changeset scripts, and the Release Pull Request workflow.
• release.yml's next preview no longer calls changeset version --snapshot. It publishes <next patch>-next.<run id>, for example 0.1.1-next.123.
• pr.yml drops the Release title bypass. release-please titles are conventional, so they pass the check without one.
• .prettierignore covers the release-please-written CHANGELOG and manifest. release-please emits * bullets and blank-line runs that prettier --check would reject, which would fail both the release PR's CI and the publish gate.
• Rewrites docs/RELEASING.md and updates TODO.md.
• New contract tests in test/release-contracts.test.mjs cover: the tag scheme matches release.yml's validation, the manifest equals the package version, release-please uses the repo token, release.yml still triggers on published releases, no Changesets remain, and the generated files are ignored by Prettier.

The two pending changesets don't need carrying over. tidy-ssr-revalidation is covered by the fix: commit from #5, and fifty-sites-sin was a placeholder chore: bump.

Proof

• pnpm format:check, pnpm typecheck, pnpm build:package, and node --test test/release-contracts.test.mjs test/release-artifacts.test.mjs pass locally (31 tests). The full Playwright suite is left to CI.

• release-please release-pr --dry-run --target-branch=chore/release-please against this repo found the 0.1.0 release and would open:

  title: chore: release 0.1.1
  ## [0.1.1](https://github.com/module-federation/tanstack/compare/0.1.0...0.1.1)
  ### Bug Fixes
  * stabilize TanStack SSR remote revalidation (#5)
  

Before merging

• REPO_SCOPED_TOKEN needs contents and pull-requests write access on this repo. The old workflow already needed that.
• Once this merges, the first Release Please run should open the 0.1.1 release PR.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/module-federation/tanstack/@module-federation/tanstack@9

commit: 7984a7e