[wentz-s]

Summary

Publishes a GitHub release whenever a v* tag is pushed, and bumps every workspace to 1.0.0 so the first one can be cut once this merges.

• .github/workflows/release.yml: a tag push runs the CI checks again (ci.yml via workflow_call, as the dev deploy does), refuses a tag that does not match the root package.json version, then runs gh release create with the notes below. A hyphenated tag (v1.1.0-rc.1) is published as a pre-release. The workflow defaults to contents: read and only the publish job gets contents: write; there is no AWS access and nothing is deployed.
• .github/scripts/release-notes.mjs: builds the notes from the squash-merge subjects since the previous v* tag, grouped into Features, Fixes, Docs and Maintenance by their prefix (feat(…), (CF-xx) Fix/…, …), with anything else under Other. GitHub's own generated notes group by PR label, and none of our PRs are labelled. A final release skips pre-release tags when finding its predecessor, so v1.1.0 covers everything since v1.0.0 rather than since v1.1.0-rc.1. From the second release on, the notes end with a compare link.
• Versions: root and all four workspaces go to 1.0.0 via npm version --workspaces --include-workspace-root, so package-lock.json changes only in version fields (the root had none before, so it gains two).
• README: a "Releases" section on how to cut one.

No build is attached to the release. The edge bundle and the console bundle bake in their deployment's config (table, Cognito, API URL) when Terraform applies them, so a prebuilt zip would not work anywhere. Consumers pin the modules to the tag (?ref=v1.0.0) instead.

Once merged:

git fetch origin && git tag v1.0.0 origin/dev && git push origin v1.0.0

Tests

npm run lint is clean. I ran the notes script against temporary local tags, deleted afterwards: a first release covers the whole history, a later release covers only the commits since the previous tag, and a final release after a pre-release skips back past it. On the current dev it lists 22 features, 24 fixes, 2 docs, 3 maintenance, and the initial commit under Other. I couldn't lint the workflow itself (actionlint isn't installed here), so the first real run is the v1.0.0 tag push.

Ticket

CF-61

Checklist

• CI is green (lint, typecheck, schemas)
• If the rule shape changed: shared/ schemas and their shared/examples/ were updated together (n/a)
• If the rule shape changed and the console API exists (step 2): its OpenAPI spec $refs the updated schemas — no inline redefinition (n/a)
• The module still takes no input about, and creates no, aws_cloudfront_distribution (except under examples/)