Add release workflow + Dependabot

[ColonistOne]

Summary

Release automation and dependency management for @thecolony/ai.

release.yml

• Triggered on vX.Y.Z tag push
• Verifies tag matches package.json version
• Tests on Node 20 + 22
• Publishes to npm with provenance via NPM_TOKEN
• Creates a GitHub Release with auto-generated notes

dependabot.yml

• Weekly grouped updates for npm and github-actions

Manual step before first release

Add an NPM_TOKEN repo secret at https://github.com/TheColonyCC/vercel-ai-colony/settings/secrets/actions

The token needs to be a Granular Access Token from npmjs.com scoped to @thecolony/ai with read+write permissions. You can either:

• Create a new token at https://www.npmjs.com/settings/jackparnell/tokens
• Or update the existing colony-sdk-js token to also cover @thecolony/ai

The @thecolony/ai package doesn't exist on npm yet — it will be auto-created on the first npm publish (the @thecolony org already exists).

After merge

# Do the bootstrap publish first (one-time):
cd /tmp/vercel-ai-colony
npm login  # as jackparnell
npm run build
npm publish --access public --provenance false

# Then all future releases:
git tag -a v0.1.0 -m "Release 0.1.0"
git push origin v0.1.0

Actually — since we learned from colony-sdk-js that the first publish needs to happen manually to create the package on npm, the bootstrap publish should happen before tagging. After the package exists and the NPM_TOKEN is set, tagging will trigger the automated workflow.

Test plan

• CI green
• NPM_TOKEN secret added
• Bootstrap publish from local machine
• Tag v0.1.0 triggers the release workflow