chore(release): Harden agent npm and desktop release pipelines

.changeset/README.md

@@ -0,0 +1,15 @@
+# Changesets
+
+This folder drives releases of `@posthog/agent`, the only npm-published package
+in this repo. A merged changeset triggers the release pipeline in
+`.github/workflows/agent-release.yml`, which prepares and verifies a release
+candidate and then waits for human approval before publishing.
+
+To request a release, run `pnpm changeset` at the repo root, select
+`@posthog/agent`, pick a semver bump and describe the change. Changes to
+`packages/shared`, `packages/git` or `packages/enricher` also ship through
+`@posthog/agent` (they are bundled into it), so changesets for those changes
+must target `@posthog/agent` too.
+
+See `packages/agent/RELEASING.md` for the full release process and
+[changesets docs](https://github.com/changesets/changesets) for the format.

.changeset/config.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "restricted",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "bumpVersionsWithWorkspaceProtocolOnly": true,
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  },
+  "ignore": []
+}

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Release-critical files: edits here can reshape or bypass the npm publish
+# approval gate, so they require review by the release owners.
+/.github/CODEOWNERS @PostHog/team-posthog-code
+/.github/workflows/agent-release.yml @PostHog/team-posthog-code
+/.changeset/config.json @PostHog/team-posthog-code
+/packages/agent/package.json @PostHog/team-posthog-code

.github/pull_request_template.md

@@ -18,3 +18,4 @@
 
 - [ ] Publish to changelog?
 - [ ] Alert Sales and Marketing teams?
+- [ ] Added a changeset? (required to ship `packages/agent`, `shared`, `git` or `enricher` changes to npm; run `pnpm changeset`)