feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/lib/10_drone_pipelines/index.html

@@ -769,7 +769,7 @@ chosen by what the repository produces:</p>
 <td><strong>B — Docker deployment</strong></td>
 <td><code>templates/drone/service-docker.yaml</code></td>
 <td>An image pushed to the registry and run as a container</td>
-<td><code>auth-server</code>, <code>docs</code>, <code>mcp</code></td>
+<td><code>auth-server</code></td>
 </tr>
 </tbody>
 </table>
@@ -808,30 +808,25 @@ with <code>from_secret</code> — never commit credentials.</p>
 </ul>
 <hr />
 <h2 id="type-b-docker-deployment-service-dockeryaml">Type B — Docker deployment (<code>service-docker.yaml</code>)</h2>
-<p>For services and sites that ship a container image. The file contains <strong>two
-pipelines</strong>, each mirroring a repo family:</p>
-<ol>
-<li><strong><code>build-and-deploy-service</code></strong> — triggered on <code>tag</code> (a long-running
-   API/worker service, e.g. <code>auth-server</code>):</li>
+<p>For a service that ships a container image — a long-running API/worker, e.g.
+<code>auth-server</code>. The file contains <strong>one pipeline</strong>, <code>build-and-deploy-service</code>,
+triggered on <code>tag</code>:</p>
+<ul>
 <li><code>fetch-tags</code> — resolve the latest tag into <code>LATEST_TAG.txt</code>; fail if there
-     are no tags.</li>
+  are no tags.</li>
 <li><code>check-version</code> — <strong>guard</strong>: fail unless <code>$DRONE_TAG</code> equals the repo-root
-     <code>VERSION</code> file (see <a href="../11_versioning_and_changelog/">11 – Versioning &amp; Changelog</a>).</li>
+  <code>VERSION</code> file (see <a href="../11_versioning_and_changelog/">11 – Versioning &amp; Changelog</a>).</li>
 <li><code>check-remote-image</code> — if <code>aetos/&lt;app&gt;:&lt;tag&gt;</code> already exists locally, exit
-     <code>78</code> and skip the build.</li>
+  <code>78</code> and skip the build.</li>
 <li><code>quality-gate</code> — install from <code>requirements.txt</code> and run
-     <code>black</code> / <code>ruff</code> / <code>mypy</code> / <code>pytest</code>.</li>
+  <code>black</code> / <code>ruff</code> / <code>mypy</code> / <code>pytest</code>.</li>
 <li><code>build-image</code> — <code>docker build</code> with the private-index build args, tagged
-     <code>aetos/&lt;app&gt;:&lt;tag&gt;</code> and <code>:latest</code>.</li>
+  <code>aetos/&lt;app&gt;:&lt;tag&gt;</code> and <code>:latest</code>.</li>
 <li><code>push-image</code> — login, re-tag with <code>$REGISTRY_HOST</code>, push both tags.</li>
 <li><code>stop-old</code> — <code>docker rm -f &lt;app&gt;</code>.</li>
 <li><code>run-container</code> — <code>docker run -d --name &lt;app&gt; -p &lt;host&gt;:&lt;container&gt;
-     --restart always</code> with the service's <code>-e</code> environment.</li>
-<li><strong><code>build-and-deploy-site</code></strong> — triggered on <code>push</code> (a static/HTTP site, e.g.
-   <code>docs</code>, <code>mcp</code>): <code>build-image</code> → <code>push-image</code> → <code>stop-old</code> → <code>run-container</code>,
-   with no tag resolution, no quality gate, and no version guard (it ships
-   <code>:latest</code> only).</li>
-</ol>
+  --restart always</code> with the service's <code>-e</code> environment.</li>
+</ul>
 <p>Secrets: <code>PIP_REPO_URL</code>, <code>PIP_USERNAME</code>, <code>PIP_PASSWORD</code> (service build args),
 <code>REGISTRY_HOST</code>, <code>REGISTRY_USER</code>, <code>REGISTRY_PASS</code>, plus the service runtime env
 (for example <code>MONGO_*</code>, <code>JWT_SECRET</code>).</p>
@@ -861,11 +856,6 @@ pipelines</strong>, each mirroring a repo family:</p>
 <td><code>9003:8000</code></td>
 </tr>
 <tr>
-<td><code>&lt;site&gt;</code></td>
-<td>site image / container name</td>
-<td><code>docs</code></td>
-</tr>
-<tr>
 <td><code>&lt;ENV_VAR&gt;</code></td>
 <td>runtime environment variable</td>
 <td><code>MONGO_HOST</code></td>
@@ -883,8 +873,7 @@ pipelines</strong>, each mirroring a repo family:</p>
   version to equal the tag; a service needs a root <code>VERSION</code> file that equals
   the tag. See <a href="../11_versioning_and_changelog/">11 – Versioning &amp; Changelog</a>.</li>
 <li>Do not rename the pipelines; tooling and runbooks key off
-  <code>build-and-publish-pypi</code>, <code>build-and-deploy-service</code>, and
-  <code>build-and-deploy-site</code>.</li>
+  <code>build-and-publish-pypi</code> and <code>build-and-deploy-service</code>.</li>
 </ul>
 <hr />
 <h2 id="related">Related</h2>