feat: enforce conventional commits and generate the changelog from them

[joshunrau]

Summary

• Commit convention, enforced twice. commitlint.config.ts extends @commitlint/config-conventional and derives the permitted scopes from the 27 @opendatacapture/* workspace names in pnpm-workspace.yaml (vendor/** excluded on purpose). An unknown type is an error; an unknown scope is a warning for now (Raise the commit scope check from a warning to an error #1529). A husky commit-msg hook checks locally, and a new Commitlint workflow checks the commits a pull request adds, on PRs to any branch, so forks are covered.
• Changelog generator. scripts/changelog.ts reads the commits since the last v* tag with conventional-commits-parser. recommend prints the strict-SemVer bump, write <version> inserts a section (Breaking Changes, Features, Bug Fixes, Performance) into CHANGELOG.md and regenerates the docs-site copy, and section <version> prints one section. scripts/increment-version.sh now shows the recommendation before its menu and runs the generator after the bump. Non-conforming commits are skipped with a warning (Raise the commit scope check from a warning to an error #1529 tracks making that an error); a revert cancels its target when both are in the range.
• Release body. The release job extracts the new section and passes it as the GitHub release body, and fails when the section is missing rather than publishing an empty body.
• CHANGELOG.md starts with the former v2.0.0 upgrade guide, verbatim. The docs site gets a single Changelog sidebar link to a generated page; the Updating section is removed.
• Root lint. tsconfig.base.json is renamed to tsconfig.json so eslint's typed rules and tsc can see the root-level scripts and configs, and a lint:root turbo task runs them as part of pnpm lint. The root files leave the eslint ignore list; the findings that surfaced are fixed.
• Docs. CONTRIBUTING.md, the root AGENTS.md, docs/AGENTS.md, apps/outreach/AGENTS.md, the cut-a-release playbook, the release skill, the workspace map and the testing strategy are updated. No tests for scripts/, by decision, recorded in the root AGENTS.md.

New root devDependencies, via the catalog: @commitlint/cli, @commitlint/config-conventional, conventional-commits-parser.

Test plan

• pnpm lint (34 tasks, including //#lint:root)
• pnpm test (1153 passed)
• pnpm test:e2e (172 passed)
• pnpm --filter @opendatacapture/outreach build renders /en/docs/changelog/ with the sidebar link
• Hook: feature: x rejected, fix(api): x accepted, fix(deps): x warns
• increment-version.sh dry run to 2.3.0 produced the expected section, then reverted
• First real release after merge: confirm the GitHub release body is the CHANGELOG.md section
• The four Dockerfiles now copy tsconfig.json; nothing local builds the images, so the release build job is the check

🤖 Generated with Claude Code