feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/lib/15_repository_inventory/index.html

@@ -557,9 +557,9 @@
 </li>
       
         <li class="md-nav__item">
-  <a href="#services-sites-type-b" class="md-nav__link">
+  <a href="#services-type-b" class="md-nav__link">
     <span class="md-ellipsis">
-      Services &amp; sites (Type B)
+      Services (Type B)
     </span>
   </a>
   
@@ -711,9 +711,9 @@
 </li>
       
         <li class="md-nav__item">
-  <a href="#services-sites-type-b" class="md-nav__link">
+  <a href="#services-type-b" class="md-nav__link">
     <span class="md-ellipsis">
-      Services &amp; sites (Type B)
+      Services (Type B)
     </span>
   </a>
   
@@ -837,14 +837,13 @@ Paths are relative to the <code>aetos/</code> workspace root.</p>
 </tbody>
 </table>
 <hr />
-<h2 id="services-sites-type-b">Services &amp; sites (Type B)</h2>
+<h2 id="services-type-b">Services (Type B)</h2>
 <p>A container image pushed to the registry and run on the Docker host. Version
 source is the <code>VERSION</code> file; Drone file is <code>service-docker.yaml</code>.</p>
 <table>
 <thead>
 <tr>
 <th>Repo</th>
-<th>Type</th>
 <th>Path</th>
 <th>Trigger</th>
 <th>Docs</th>
@@ -853,29 +852,13 @@ source is the <code>VERSION</code> file; Drone file is <code>service-docker.yaml
 <tbody>
 <tr>
 <td><code>auth-server</code></td>
-<td>service</td>
 <td><code>auth-server</code></td>
 <td>tag</td>
 <td>api, lib, wiki</td>
 </tr>
-<tr>
-<td><code>docs</code></td>
-<td>site</td>
-<td><code>docs</code></td>
-<td>push</td>
-<td>—</td>
-</tr>
-<tr>
-<td><code>mcp</code></td>
-<td>site</td>
-<td><code>mcp</code></td>
-<td>push</td>
-<td>—</td>
-</tr>
 </tbody>
 </table>
-<p>The <strong>service</strong> variant is tag-triggered and enforces <code>tag == VERSION</code>. The
-<strong>site</strong> variant is push-triggered, ships <code>:latest</code>, and has no tag guard.</p>
+<p>Tag-triggered and enforces <code>tag == VERSION</code>.</p>
 <hr />
 <h2 id="required-files-per-repo">Required files per repo</h2>
 <table>
@@ -895,7 +878,7 @@ source is the <code>VERSION</code> file; Drone file is <code>service-docker.yaml
 <td><code>python-lib.yaml</code></td>
 </tr>
 <tr>
-<td>service / site</td>
+<td>service</td>
 <td><code>VERSION</code></td>
 <td><code>CHANGELOG.md</code></td>
 <td><code>service-docker.yaml</code></td>