ci: adopt the shared release flow (candidate / settle / publish)

[Troublor]

Second of the four repos moving onto the org release pipeline (megaeth-labs/.github: release-candidate → release-settle → release-publish). This is the core half only: the two tag-triggered archive workflows (release.yaml, release-tracing.yaml) stay as they are and fire from the app's tag push; they move to the shared upload action in the extension half.

What changes

• CHANGELOG.md (header; the first candidate drafts the v2.0.18 entry from the PRs since v2.0.17).
• Three workflows stamped from the shared templates: Release Candidate (dispatch → PR bumping [workspace.package] version in Cargo.toml + Cargo.lock, then cuts release-vX.Y.Z on merge), Release Settle, Release Publish (annotated tag by the mega-maxwell app + GitHub Release).
• Verified locally that cargo update --workspace --offline after the bump touches only the workspace crate entries in Cargo.lock.

Before the first dispatch (admin)

1. Org secret MEGA_MAXWELL_PK and variable MEGA_MAXWELL_CLIENT_ID must be visible to this public repo.
2. Tag ruleset for v*: creation/update/deletion/non-fast-forward restricted; bypass = repository admins + the mega-maxwell app.
3. Branch ruleset for release-*: PR required, no delete/force-push.
4. Depends on feat(release-candidate): bump_command for lockfiles and lockstep versions .github#25 (bump_command).

First release through it

Dispatch Release Candidate 2.0.18 from main → approve/merge (2 approvals + code owners per the main ruleset) → Release Settle on the branch tip → merge → v2.0.18 tag + Release → release.yaml / release-tracing.yaml archive to Artifact Registry as today.

🤖 Generated with Claude Code

[mega-maxwell]

Claude review status

Living comment — rewritten in place. The review workflow keeps this single comment up to date instead of posting a new one each round, so it always describes the latest reviewed commit and the earlier text is intentionally gone. No reply is needed here; reply to a finding in its own review thread, and answer an open question in a reply on this PR. The next review round reconciles your answer.

✅ Review clean

Last reviewed: head 02d0b5fa · updated 2026-09-07T12:51:11+00:00

New this round: 0 finding(s), 0 question(s) · Resolved this round: 0 · Open questions: 0

[claude]

Label check: this PR currently has no labels, but it should have agent.

This PR is agent-generated (footer: "🤖 Generated with Claude Code") and is a ci:-type change, matching PR #146 ("ci: use centralized mega-agents Claude CI actions"), which is also agent-generated and carries only the agent label. Other agent-authored PRs in this repo (#156, #143) follow the same pattern — agent plus a type label only when one clearly applies (e.g. bug for a bug fix). There's no ci-specific label in this repo, so agent alone is the expected label set here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T06:50:29.253875Z	02d0b5f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.