ci: adopt release-please for versioning and PyPI publishing (#684)

[Brad-Edwards]

Summary

Adopts release-please for versioning + PyPI publishing (#684), replacing the committed-literal/tools/release.py machinery from #689. release-please owns CHANGELOG.md and the version, derived from the Conventional Commit history on main — feature PRs never touch CHANGELOG.md (no fragment collisions).

What changed

• Deleted the prior release machinery: towncrier.toml, changelog.d/ (192 fragments — collated one last time into CHANGELOG.md §0.18.0 so nothing is lost), tools/release.py + its test, and the committed-literal release.yml. Reverted the compat-wrapper policy relaxation (no longer needed).
• release-please-config.json + .release-please-manifest.json — version source of truth {".": "0.18.0"}.
• .github/workflows/release-please.yml — release-please job maintains the release PR; a gated publish job builds the corpus-bundled wheel/sdist, verifies the corpus ([FEATURE] Ship the contract corpus as package data and cut versioned releases so conformance + validation work from an installed wheel #537), publishes to PyPI via OIDC, attaches dists. Actions SHA-pinned.
• pyproject.toml — static [project] version = "0.18.0" (release-please bumps it); removed hatch-vcs/[tool.hatch.version].
• src/aces/__init__.py — __version__ derives from installed dist metadata via package_version (kept the compat wrapper).
• Updated .gc/plan-rules.md, docs/explain/releasing.md, CHANGELOG.md preamble.

aces-specific adaptations (deviations from the generic spec, all deliberate)

• __init__.py uses package_version (from aces._compat), not from importlib.metadata import version — the compat-wrapper policy only permits imports from aces._compat. Same effect (derives from the dist version release-please bumps).
• Monorepo: package is at repo root . (so CHANGELOG.md stays at root, where README/docs link it); the real version literal in implementations/python/pyproject.toml is bumped via extra-files ($.project.version).
• 192 fragments preserved by collating into CHANGELOG.md §0.18.0 before deleting changelog.d/.

Verified locally

• Build → aces_sdl-0.18.0 (static [project] version), 232 corpus files.
• JSON config + workflow YAML valid; ruff clean; check_repo_policy.py green; 168 policy/manifest tests pass.
• Confirmed the rego changelog-required rule and authority-boundary checks are not CI-wired, so removing changelog.d doesn't break verify.

Requires (maintainer)

1. Update the PyPI pending publisher workflow name from release.yml → release-please.yml (or add a second) — else only the publish step 403s.
2. The release PR won't auto-run required checks (opened by GITHUB_TOKEN): admin-merge it, or give release-please a PAT.

Residual (optional, not CI-enforced)

The dormant rego changelog-required rule + adr_policy.yaml: changelog_fragment_dir still reference changelog.d; harmless (not run in CI) but can be cleaned up separately.

Supersedes the committed-literal model (#689). The corpus-bundled wheel (#537) is retained.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud