ci: release through cyberuni OIDC and point metadata at cyberuni

[unional]

What this does

Phase A of the modernization sweep for assertron. It moves both CI jobs to cyberuni's
reusable workflows, replaces the long-lived NPM_TOKEN / CI_GITHUB_TOKEN release with npm
trusted publishing (OIDC), and points repository metadata at the post-transfer URLs.

Do not merge yet. This PR is deliberately written against the world after the repo is
transferred to cyberuni. It lands only once the transfer and the npm trust registration for
assertron have happened.

Workflows

• pull-request.yml → cyberuni/.github/.github/workflows/pnpm-verify.yml@main, pinned to
  os: '["ubuntu-latest"]' (cyberuni's default matrix is 3 OS x 2 Node = 6 jobs; this package has
  no platform-specific behaviour, so the full matrix triples CI cost for nothing) and
  skip-playwright: true (no browser tests). Codecov upload is left on — it feeds the README badge.
• merge_group: added to pull-request.yml, so a merge queue can be turned on after the transfer
  without stranding every PR on a check that never starts.
• publish-gate job added, gated on changeset-release/*. It diffs the tarball contents and
  runtime dependencies against the published version — the last reviewable point before a publish.
• release.yml → cyberuni/.github/.github/workflows/pnpm-release-changeset-oidc.yml@main with an
  explicit permissions: block (id-token / contents / pull-requests: write) and no
  secrets: inherit.
• grep -rn "unional/.github" .github/workflows/ now returns nothing.

Metadata

• package.json repository / homepage / bugs → cyberuni/assertron. The npm package name
  stays assertron; the npm scope does not follow the GitHub org.
• README badges → cyberuni/assertron. The GitHub Actions badge pointed at a nodejs workflow that
  has not existed for years, and the codecov badge at branch/master; both are corrected. The
  Semantic Release badge is replaced with a changesets one — this repo has released with changesets
  for a long time.

Legacy files removed

• .yarnrc.yml — sets yarnPath: .yarn/releases/yarn-3.6.1.cjs, and .yarn/releases/ is not in the
  repo. Every CI run therefore prints a MODULE_NOT_FOUND stack trace during the reusable
  workflow's environment-details step (which runs yarn --version). It is non-fatal, but it looks
  exactly like a build failure and has already been mis-diagnosed as one.
• .releaserc.json — semantic-release config left behind by the changesets migration. Nothing reads it.

Changeset

A deliberate patch. The change itself is repo-internal, but without a changeset the first release
after the transfer runs green and publishes nothing, so there is no way to prove OIDC publishing
works.

Pre-existing state, for the record

• package.json version 11.5.2 matches latest on the registry. No placeholder version.
• main was green before this PR. The most recent pull-request and release runs on main
  both succeeded. A board note had this repo down as red with "Cannot find module — an undeclared
  dependency"; that is a misread. The Cannot find module line is the non-fatal .yarnrc.yml
  warning described above, printed on green runs too.
• The one red run is PR chore(deps): update jest monorepo to v30 - autoclosed #305 (renovate/major-jest-monorepo, jest v30). Its actual failure is
  [ERR_PNPM_IGNORED_BUILDS] Ignored build scripts: unrs-resolver@1.12.2 — that transitive
  dependency only appears in that branch's lockfile, not on main. It is Renovate's PR to fix, not
  this one; the fix there is to add unrs-resolver: true to allowBuilds in pnpm-workspace.yaml.
• 18 open Dependabot alerts, all scope: development — none reach consumers of the published
  package. Left for the toolchain/dependency phase.

Repo settings applied alongside this PR

• Baseline main ruleset created (requires code / all-checks and the CodeQL code-scanning rule;
  no codecov/* contexts, no required_linear_history), then the legacy branch protection removed —
  in that order, so main was never unprotected.
• Merge settings converged on the merge-commit baseline: merge commits on, squash and rebase off,
  allow_update_branch on.
• default_workflow_permissions stays write until this PR (which carries the permissions: block)
  has landed. Lowering it first would startup_failure the next release with no logs.
• NPM_TOKEN / CI_GITHUB_TOKEN are left in place until a publish has proven OIDC works.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4a1ad39

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
assertron	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.35%. Comparing base (5fe789d) to head (4a1ad39).
⚠️ Report is 53 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #344   +/-   ##
=======================================
  Coverage   96.35%   96.35%           
=======================================
  Files          24       24           
  Lines         357      357           
  Branches       63       60    -3     
=======================================
  Hits          344      344           
  Misses         13       13           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request