ci(release): add reusable release-please workflow and dogfood it (#16)

* ci: add reusable release-please workflow

- workflow_call entry point wrapping googleapis/release-please-action@45996ed (v5.0.0)
- SHA-pinned, job-level permissions (contents/pull-requests/issues: write)
- optional release-type input (default simple), no target-branch input so callers' own default branch auto-detects

* ci(release): dogfood the reusable release-please workflow

- release-please-config.json: release-type simple, package ".", changelog-path CHANGELOG.md
- .release-please-manifest.json: bootstrap ".": "0.0.0" (org-dotgithub has zero GitHub tags today)
- .github/workflows/release-please.yml: push-to-main trigger, calls release-please-reusable.yml pinned to this branch's first commit SHA
- docs/RELEASE_POLICY.md: document tool choice, uniform release-type, per-repo independent SemVer, bootstrap baseline rationale, and SHA-pin policy

---------

Co-authored-by: Kim Harjamäki <kim.harjamaki@prosimo.fi>

Author: OgeonX-Ai

.github/workflows/release-please-reusable.yml

@@ -0,0 +1,22 @@
+name: Release Please (reusable)
+on:
+  workflow_call:
+    inputs:
+      release-type:
+        description: "release-please release-type strategy"
+        type: string
+        default: simple
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          release-type: ${{ inputs.release-type }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.github/workflows/release-please.yml

@@ -0,0 +1,12 @@
+name: Release Please
+on:
+  push:
+    branches:
+      - main
+jobs:
+  release-please:
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    uses: Coding-Autopilot-System/.github/.github/workflows/release-please-reusable.yml@f288e5e3b67b29a2c08880b76da7b852f4a132d0

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

docs/RELEASE_POLICY.md

@@ -29,3 +29,40 @@ rewriting published history.
 Repositories that are demonstrations or not yet stable must state that clearly in
 their README. They still require reproducible setup, validation evidence, and explicit
 safety boundaries.
+
+## Release Automation (v1.5)
+
+1. **Tool: release-please via a single reusable workflow.** All 13 portfolio repos
+   call `.github/workflows/release-please-reusable.yml` in this repo
+   (`Coding-Autopilot-System/.github`) instead of each hand-rolling a
+   semver-bump/changelog script or duplicating a release-please config 13 times.
+   release-please deterministically parses conventional commits — already enforced
+   org-wide by pr-lint's PR-title check — rather than reinventing that parsing logic,
+   and its default flow opens a review-gated "release PR" rather than tagging
+   directly on every merge, which fits the existing two-party-review governance
+   instead of fighting it.
+2. **Uniform `release-type: simple` across all 13 repos**, regardless of language
+   (C#, Python, Node, PowerShell, docs-only). `simple` only manages a
+   `CHANGELOG.md` + version manifest and never mutates a language-specific manifest
+   file, avoiding 13 different per-language configurations.
+3. **Each repo keeps its own independent SemVer line** — not synced to the CAS
+   portfolio milestone number (e.g. v1.5). gsd-orchestrator (already at v4.0.0) and
+   cas-contracts (already at v1.1.1) already prove per-repo versioning is
+   independent of portfolio milestone numbering; forcing a shared baseline across
+   repos with unrelated existing tag histories would be meaningless and would
+   collide with gsd-orchestrator's real v4.x line.
+4. **Bootstrap baseline.** Repos with zero existing GitHub tags (including this
+   repo, org-dotgithub) bootstrap their `.release-please-manifest.json` at
+   `"0.0.0"` so release-please's first run computes the genuine first version from
+   complete commit history. Repos with a real existing latest tag on GitHub (e.g.
+   gsd-orchestrator at `4.0.0`, cas-contracts at `1.1.1`) bootstrap their manifest
+   from that real tag so their first automated release only covers what changed
+   since that point. Baselines are verified against `gh api .../tags` output, not
+   assumed from local-only tags.
+5. **SHA-pinned cross-repo dependency.** Other repos pin their caller workflow's
+   `uses:` line to a specific org-dotgithub commit SHA (never `@main`), and the
+   third-party `googleapis/release-please-action` inside this reusable workflow is
+   itself SHA-pinned, per the existing Phase 31 org action-pinning policy. Bumping
+   the pinned release-please-action version later requires a deliberate, reviewed
+   SHA update in each caller — the same accepted maintenance tradeoff Phase 31
+   already established for direct action pins.

release-please-config.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "release-type": "simple",
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "changelog-path": "CHANGELOG.md"
+    }
+  }
+}