chore: require manual version pull requests

[GrahamQuan]

Summary

• keep GitHub Actions unable to create or approve pull requests
• require maintainers to generate and open Version PRs manually
• remove pull-requests: write and the Changesets PR automation from the release job
• publish with npm OIDC only after all Changesets have been consumed by a reviewed Version PR
• push immutable Changesets tags after a successful publish

Why

GitHub combines permission to create pull requests with permission to approve them. Keeping that repository setting
disabled preserves the independent human-review boundary and reduces the authority granted to GITHUB_TOKEN.

Validation

• pnpm check
• release workflow YAML parse check
• git diff --check