feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/src/templates/release/CHANGELOG.md

@@ -20,9 +20,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
 
 <!--
-In the release merge request, promote the entries above into a new heading and
-leave a fresh, empty [Unreleased] section. Name the version/tag, never a commit
-id:
+In the release merge request, first reconcile the entries above against the
+change: diff it against the last tag (`git log <last-tag>..HEAD`,
+`git diff --stat <last-tag>..HEAD`) and add any missing user-facing entries.
+`[Unreleased]` is a draft — always show the additions to the user for approval
+before promoting. Then promote the entries above into a new heading and leave a
+fresh, empty [Unreleased] section. Name the version/tag, never a commit id:
 
 ## [0.1.0] - YYYY-MM-DD