[prisis]

What

Replaces the custom OIDC publish workflow with semantic-release for the single package, following the visulima/lunora house pattern:

• packages/deepsec/.releaserc.json extends @anolilab/semantic-release-preset/pnpm (commit-analyzer, release-notes-generator, changelog, clean-package-json, @anolilab/semantic-release-pnpm, git, github — conventionalcommits preset, main release branch)
• New .github/workflows/semantic-release.yml modeled on lunora's: push to main + workflow_dispatch, serialized concurrency, full-history checkout, pnpm validate + pnpm bundle before release, id-token: write for OIDC trusted publishing with automatic provenance, NPM_TOKEN as fallback
• Deletes .github/workflows/release.yml (one-shot OIDC publish) and .github/workflows/bump-version.yml (versions now come from conventional commits)
• Version reset 2.4.0 → 2.3.10 (the last version upstream shipped to npm) + annotated tag v2.3.10 on ce64674 pushed to origin — so the first semantic-release run computes and publishes 2.4.0 from the feat commits since that tag (verified locally: --dry-run reports The next release version is 2.4.0)
• CHANGELOG.md added to the tarball files list (written by @semantic-release/changelog into packages/deepsec/)
• devDeps: semantic-release, @anolilab/semantic-release-preset, @anolilab/semantic-release-pnpm, plus @visulima/yaml (optional peer of @visulima/fs used by the pnpm plugin — nothing in this workspace provided it, and its absence crashed plugin load under pnpm's strict layout)
• knip: ignoreDependencies entries for the preset chain (knip's semantic-release plugin only traces plugins, not extends) and @visulima/yaml

First-release bootstrap (one-time, npm side)

The package doesn't exist on npm yet, so a Trusted Publisher can't be configured up front. Pick one when coming back to this:

1. Token path: add a granular NPM_TOKEN repo secret → first release publishes 2.4.0 via token → then configure the Trusted Publisher at npmjs.com (repo anolilab/deepsec, workflow semantic-release.yml) and optionally delete the secret.
2. Tokenless path: pnpm bundle && pnpm --filter @anolilab/deepsec publish --access public once, then configure the Trusted Publisher — semantic-release finds 2.4.0 already on npm, skips the registry write, still creates tag/changelog/GitHub release.

Merge order matters: the v2.3.10 tag must exist before the workflow's first run (it does — pushed with this branch).

Validation

• pnpm validate green: build, biome, knip, bundle, typecheck:deepsec, 2492 tests
• Full semantic-release dry-run against the real config: all 7 plugins load, github/git/pnpm verify pass, release notes generated, next version = 2.4.0
• pnpm peers check: only pre-existing warnings (website/openai), none from the release tooling