…#70)

* fix: configure npm OIDC Trusted Publishing correctly

The previous approach installed [email protected] in a ../oidc/ prefix directory
and ran it directly, which didn't properly trigger the OIDC token exchange
for Trusted Publishing authentication.

Changes:
- Upgrade setup-node to v4 with registry-url to configure .npmrc
- Install [email protected] globally instead of in a prefix directory
- Add --provenance and --access public flags to trigger OIDC auth

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* build: fetch tsc-multi from npm instead of the Stainless-hosted tarball

package.json pinned tsc-multi to a tarball on the stainless-api GitHub
org's release assets, which goes away when that org is archived after
the Stainless sunset (2026-09-01). @stainless-api/tsc-multi is published
on npm (persists regardless); the bin name is unchanged, so scripts/build
works as before. Verified: full root + mcp-server build, pack, and sign
pass with 1.1.12.

Co-Authored-By: Claude Fable 5 <[email protected]>

* chore: take over release automation and remove Stainless dependencies

Stainless sunsets its platform for our account on 2026-09-01. This
implements Problem 1 of the design doc (landing-ai/ade-python#100):

- Add self-hosted release-please workflow (replaces the Stainless app,
  which opened release PRs and created tags/GitHub Releases externally)
- Point release-please-config.json $schema at upstream googleapis and
  drop the README.md / mcp yarn.lock extra-files (no version strings in
  either; upstream's generic updater would no-op on them)
- Simplify CI triggers to main + PRs; drop stainless-sdks runner
  conditionals and both pkg.stainless.com artifact uploads
- Bump deprecated actions/setup-node (Node 20 action runtimes leave
  GitHub runners 2026-09-16)
- Guard the DXT release-asset upload so manual workflow_dispatch runs
  don't fail on an empty release tag
- Remove .stats.yml and scripts/utils/upload-artifact.sh
- Rewrite CONTRIBUTING.md and SECURITY.md for owned, hand-maintained code
- Drop "generated with Stainless" phrasing and the vscode.stainless.com
  MCP badge from README

Co-Authored-By: Claude Fable 5 <[email protected]>

* chore: trigger CI

* chore: make releases dispatch-only with maintainer-chosen version bump

Per review: ordinary merges to main must never create release PRs.
Releases now start with a maintainer running the Release workflow and
choosing patch/minor/major; the release-please CLI opens a release PR
pinned to exactly that version (changelog and multi-file version
stamping still come from the existing config/manifest). Merging that PR
triggers the finalize job, which creates the tag + GitHub Release and
thereby the npm publish. Config drops the now-bypassed prerelease
versioning keys.

Co-Authored-By: Claude Fable 5 <[email protected]>

* chore: release directly from dispatch — no release PR

Per review: dispatching the Release workflow IS the release decision, so
the intermediate release PR is gone. The workflow now stamps the version
(package.json, src/version.ts, mcp-server package.json + manifest.json),
prepends the changelog section, lands the release commit directly on
main (requires the RELEASE_TOKEN owner to have ruleset bypass), tags it,
and creates the GitHub Release that triggers the npm publish.
release-please is fully removed (config, manifest, version annotations)
in favor of a small owned script.

Co-Authored-By: Claude Fable 5 <[email protected]>

* chore: sync release-notes script lint fixes from ade-python

Keep the shared script byte-identical across both SDK repos.

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: address Copilot review — release concurrency + cleanups

- Add a concurrency group to the Release workflow so concurrent
  dispatches queue instead of racing the version computation
- Sync the notes-script SECTION_KEYS hoist from ade-python
- Simplify release-doctor to dispatch-only (its PR trigger gated on
  release-please branch names that no longer exist)

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix: gate the release on building and testing the stamped tree

Mirror of the ade-python change: bootstrap + build + tests run on the
stamped tree, aborting the release before any commit or tag exists if
anything is red.

Co-Authored-By: Claude Fable 5 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

The SDK is hand-maintained since the Stainless exit (#100); the
"File generated from our OpenAPI spec by Stainless" headers gave
contributors guidance that contradicts CONTRIBUTING.md. Mechanical
sweep of 34 source files plus the two .keep placeholders.

Co-Authored-By: Claude Fable 5 <[email protected]>

The SDK is hand-maintained since the Stainless exit (#100); the
"File generated from our OpenAPI spec by Stainless" headers gave
contributors guidance that contradicts CONTRIBUTING.md. Mechanical
sweep of 34 source files plus the two .keep placeholders.

Co-authored-by: Claude Fable 5 <[email protected]>