fix(release): bump changesets/action to v2, and pin the checkout

[btravers]

Closes #5. Two fixes in one file family, one of them urgent.

The urgent one: v1 breaks any repo with .changeset/CLAUDE.md

changesets/action@v1 bundles @changesets/read@^0.6.7, which parses every .changeset/*.md as a changeset. A repository that keeps agent guidance beside its changesets fails the whole release:

##[error]Error: could not parse changeset - missing or invalid frontmatter.

Not hypothetical — that is btravstack/btravstack's release pipeline right now, red on every merge to main since it added a .changeset/CLAUDE.md.

@changesets/read@1.0.0, which v2 bundles, ignores README.md, AGENTS.md, CLAUDE.md and GEMINI.md. The ecosystem added that list for exactly this reason:

const ignoredMdFiles = [/^README\.md$/i, "AGENTS.md", "CLAUDE.md", "GEMINI.md"];

Worth noting why it was invisible until now: a consumer's own pnpm run version is unaffected, because the repository installs a current @changesets/read. Only the action's bundled copy is old, so the failure appears solely in CI.

It is not a version bump alone

v2 renamed every input:

v1	v2
version	version-script
publish	publish-script
commit	commit-message
title	pr-title

And github-token is an input now, not just the env var — this one would have failed silently. v2 defaults it to ${{ github.token }}, so passing the PAT through the environment alone falls back to the bot token, and a release PR opened by that starts no workflow runs. That is the single thing the PAT exists to prevent, so it is passed as an input here and kept in env as well.

Closes #5 in the same file

An optional ref input, defaulting to "" so omitting it keeps today's behaviour exactly. A caller on workflow_run passes the commit the green run measured:

uses: btravstack/tools/.github/workflows/release-reusable.yml@workflows-v1
with:
  ref: ${{ github.event.workflow_run.head_sha }}

Without it the checkout takes the default branch's current tip, which a push landing after CI went green can have moved — so a permanent npm tarball gets cut from a commit no CI run validated. btravstack/btravstack's own deploy-docs.yml already guards the identical hazard for a redeployable site; the release path wants it more.

This repository's own release.yml had both defects too and gets both fixes directly, since it inlines the action rather than calling the reusable workflow.

Also

Both workflows move off pnpm/action-setup@v4 and actions/setup-node@v4, which are forced onto Node 24 with a deprecation warning on every run. v6 and v7 are what .github/actions/setup here already uses.

After this lands

The workflows-v1 tag needs moving for consumers to pick it up. Then btravstack/btravstack can add ref: to its caller and drop the KNOWN GAP paragraph its release.yml header currently carries pointing at this issue — unthrown, entity, amqp-contract and temporal-contract get the CLAUDE.md fix for free without changing anything.