chore: make changeset:version atomic (#3505)

Follow-up to the v4.4.5 release incident where the release PR (#3406)
was merged with a stale lockfile and stale Chart.yaml, breaking npm +
helm releases. The two automation jobs (`update-lockfile`,
`bump-chart-version`) got cancelled mid-flight by `cancel-in-progress`
when the merge fired the workflow again on `main`.

This restructures `changeset:version` so all the post-version-bump
fixups happen in the same script and end up in a single atomic commit on
`changeset-release/main`, via `changesets/action`'s normal commit step.

Pattern borrowed from Cloudflare workers-sdk, Astro, shadcn/ui.

## Before

```
push: main
└── release-pr (changeset version → bumps package.jsons, opens PR)
    └── update-lockfile (separate job, separate commit)
        └── bump-chart-version (separate job, separate commit)
```

Three jobs, three commits to the release branch.

## After

```
push: main
└── release-pr
    └── changesets/action runs:
          changeset version
          pnpm install --lockfile-only
          node scripts/bump-helm-chart.mjs
          node scripts/cleanup-server-changes.mjs
        ...all staged and committed as ONE commit by the action
```

One job, one commit.

.github/workflows/changesets-pr.yml

@@ -72,84 +72,3 @@ jobs:
                 -f body="$ENHANCED_BODY"
             fi
           fi
-
-  update-lockfile:
-    name: Update lockfile on release PR
-    runs-on: ubuntu-latest
-    needs: release-pr
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout release branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: changeset-release/main
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        with:
-          version: 10.33.2
-
-      - name: Setup node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 20.20.0
-
-      - name: Install and update lockfile
-        run: pnpm install --no-frozen-lockfile
-
-      - name: Clean up consumed .server-changes/ files
-        run: |
-          set -e
-          shopt -s nullglob
-          files=(.server-changes/*.md)
-          for f in "${files[@]}"; do
-            if [ "$(basename "$f")" != "README.md" ]; then
-              git rm --ignore-unmatch "$f"
-            fi
-          done
-
-      - name: Commit and push lockfile + server-changes cleanup
-        run: |
-          set -e
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add pnpm-lock.yaml
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: update lockfile and clean up .server-changes/ for release"
-            git push origin changeset-release/main
-          else
-            echo "No changes to commit"
-          fi
-
-  bump-chart-version:
-    name: Bump Helm chart version on release PR
-    runs-on: ubuntu-latest
-    needs: update-lockfile
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout release branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: changeset-release/main
-
-      - name: Bump Chart.yaml
-        run: |
-          set -e
-          VERSION=$(jq -r '.version' packages/cli-v3/package.json)
-          sed -i "s/^version:.*/version: ${VERSION}/" ./hosting/k8s/helm/Chart.yaml
-          sed -i "s/^appVersion:.*/appVersion: v${VERSION}/" ./hosting/k8s/helm/Chart.yaml
-
-      - name: Commit and push Chart.yaml bump
-        run: |
-          set -e
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add hosting/k8s/helm/Chart.yaml
-          if ! git diff --cached --quiet; then
-            git commit -m "chore: bump helm chart version for release"
-            git push origin changeset-release/main
-          else
-            echo "Chart.yaml already at target version, no-op"
-          fi