feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/src/wiki/04_development/02_releasing.md

@@ -18,7 +18,7 @@ and the tag is created on the merged commit.
 - You know whether this is a **breaking**, **feature**, or **fix** release.
 - The version file exists:
   - package → `version` in `pyproject.toml`
-  - service / site → `VERSION` at the repo root
+  - service → `VERSION` at the repo root
 
 ---
 
@@ -38,12 +38,19 @@ line (see the reference page); once at `1.0.0`, normal SemVer applies.
 ## 🌿 Release in the MR
 
 The version is known while the change is still a merge request, so the bump
-rides along with it. Do both edits **in the MR**:
+rides along with it. Do all edits **in the MR**:
 
-- **Promote the changelog** in `CHANGELOG.md`: move the `[Unreleased]` content
-  under a new `## [x.y.z] - YYYY-MM-DD` heading, leave a fresh empty
-  `[Unreleased]` on top, and add the compare links — naming the **version/tag**,
-  never a commit id:
+- **Reconcile the changelog first.** `[Unreleased]` is a **draft, not the source
+  of truth**: diff the change against the last tag
+  (`git log <last-tag>..HEAD`, `git diff --stat <last-tag>..HEAD`) and add an
+  entry for every user-facing change that is missing. **Always show the proposed
+  additions to the user and wait for approval** before promoting — ask rather
+  than guess when an entry is ambiguous.
+
+- **Promote the changelog** in `CHANGELOG.md`: move the (now reconciled)
+  `[Unreleased]` content under a new `## [x.y.z] - YYYY-MM-DD` heading, leave a
+  fresh empty `[Unreleased]` on top, and add the compare links — naming the
+  **version/tag**, never a commit id:
 
   ```markdown
   [Unreleased]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.z...HEAD
@@ -51,7 +58,7 @@ rides along with it. Do both edits **in the MR**:
   ```
 
 - **Bump the version file** to the intended release version: `version = "x.y.z"`
-  in `pyproject.toml` (packages) or the `VERSION` file (services/sites).
+  in `pyproject.toml` (packages) or the `VERSION` file (services).
 
 ---
 
@@ -70,8 +77,8 @@ you confirm the MR is merged/squashed and tell it to proceed, the agent:
 2. Finds the commit that introduced the bump:
    - package:
      `git log -S 'version = "x.y.z"' -n 1 --format='%H %s' -- pyproject.toml`
-   - service / site:
-     `git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION`
+   - service:
+      `git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION`
 3. Verifies that commit's version file equals `x.y.z`, then tags **only** that
    commit: `git tag x.y.z <sha>`.
 4. Does **not** push — it asks you to run `git push origin x.y.z`.
@@ -86,7 +93,6 @@ you confirm the MR is merged/squashed and tell it to proceed, the agent:
 - **Type B (service):** asserts `tag == VERSION`, resolves the tag, skips if the
   image already exists, runs the quality gate, builds, pushes, and restarts the
   container.
-- **Type B (site):** triggered on push, ships `:latest` and has no tag guard.
 
 If the guard fails, nothing is published — fix the version file, amend the
 commit, and move the tag **only** if it was never pushed.