feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/mcp/templates/app/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+<!--
+Keep [Unreleased] current as you land changes. On release, reconcile it against
+the change (git log / git diff since the last tag), add any missing user-facing
+entries, and get the user's approval before promoting it into a version heading.
+See standards: Versioning & Changelog (registry://release).
+-->
+
 ## [Unreleased]
 
 ### Added

standards/mcp/templates/drone/service-docker.yaml

@@ -1,29 +1,25 @@
 # Drone standard — Type B: Docker deployment
 #
-# Canonical pipelines for services that build an image, push it to the private
-# registry, and run it on the Docker host (auth-server, docs, mcp).
+# Canonical pipeline for a service that builds an image, pushes it to the
+# private registry, and runs it on the Docker host (auth-server).
 #
-# Two variants ship together:
-#   build-and-deploy-service — a long-running API/worker service: fetch the git
-#                              tag, skip if the image already exists, run the
-#                              quality gate, build, push, restart the container.
-#   build-and-deploy-site    — a static/HTTP site: build, push, restart, on
-#                              every push (no tag, no quality gate).
+#   build-and-deploy-service — fetch the git tag, fail unless it equals the
+#                              repo-root VERSION file, skip if the image already
+#                              exists, run the quality gate, build, push, and
+#                              restart the container.
 #
-# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD (service only),
-# REGISTRY_HOST, REGISTRY_USER, REGISTRY_PASS, plus the service's runtime env
-# (for example MONGO_* / JWT_SECRET).
+# Secrets (Drone): PIP_REPO_URL, PIP_USERNAME, PIP_PASSWORD, REGISTRY_HOST,
+# REGISTRY_USER, REGISTRY_PASS, plus the service's runtime env (for example
+# MONGO_* / JWT_SECRET).
 #
 # Placeholders to set per repo:
 #   <app>            image / container / network name (e.g. auth-server).
 #   aetos/<app>      image repository on the private registry.
 #   <host-port>      published host port; <container-port> the in-image port.
-#   <site>           site image name for the site variant (e.g. docs, mcp).
 #   <env-var>        runtime environment variable consumed by the service.
 #
-# Version guard: the tag-triggered service variant fails unless the git tag
-# equals the repo-root VERSION file (see the versioning standard). The
-# push-triggered site variant ships :latest only and has no version to guard.
+# Version guard: the tag-triggered pipeline fails unless the git tag equals the
+# repo-root VERSION file (see the versioning standard).
 ---
 kind: pipeline
 type: docker
@@ -203,75 +199,3 @@ trigger:
   event:
     - tag
 
----
-kind: pipeline
-type: docker
-name: build-and-deploy-site
-
-platform:
-  os: linux
-  arch: arm64
-
-workspace:
-  path: /drone/src
-
-volumes:
-  - name: dockersock
-    host:
-      path: /var/run/docker.sock
-
-steps:
-  - name: build-image
-    image: docker:24
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Building Docker image for aetos/<site>..."
-      - docker build -t aetos/<site>:latest .
-
-  - name: push-image
-    image: docker:24
-    environment:
-      REGISTRY_HOST:
-        from_secret: REGISTRY_HOST
-      REGISTRY_USER:
-        from_secret: REGISTRY_USER
-      REGISTRY_PASS:
-        from_secret: REGISTRY_PASS
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Logging into registry $REGISTRY_HOST ..."
-      - echo "$REGISTRY_PASS" | docker login $REGISTRY_HOST -u "$REGISTRY_USER" --password-stdin
-      - docker tag aetos/<site>:latest $REGISTRY_HOST/aetos/<site>:latest
-      - echo "Pushing image to $REGISTRY_HOST..."
-      - docker push $REGISTRY_HOST/aetos/<site>:latest
-
-  - name: stop-old
-    image: docker:24
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Stopping old container..."
-      - docker rm -f <site> || true
-
-  - name: run-container
-    image: docker:24
-    volumes:
-      - name: dockersock
-        path: /var/run/docker.sock
-    commands:
-      - echo "Starting aetos/<site>:latest ..."
-      - |
-        docker run -d \
-          --name <site> \
-          -p <host-port>:<container-port> \
-          --restart always \
-          aetos/<site>:latest
-
-trigger:
-  event:
-    - push

standards/mcp/templates/release/CHANGELOG.md

@@ -20,9 +20,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 
 <!--
-In the release merge request, promote the entries above into a new heading and
-leave a fresh, empty [Unreleased] section. Name the version/tag, never a commit
-id:
+In the release merge request, first reconcile the entries above against the
+change: diff it against the last tag (`git log <last-tag>..HEAD`,
+`git diff --stat <last-tag>..HEAD`) and add any missing user-facing entries.
+`[Unreleased]` is a draft — always show the additions to the user for approval
+before promoting. Then promote the entries above into a new heading and leave a
+fresh, empty [Unreleased] section. Name the version/tag, never a commit id:
 
 ## [0.1.0] - YYYY-MM-DD