feat(standards): drop the site CI variant + require changelog reconciliation before release

- Remove the push-triggered build-and-deploy-site pipeline and every "site"
  reference; Type B is now a single tag-triggered service pipeline
  (service-docker.yaml).
- Inventory now covers packages + the auth-server service only (repos.json
  11 -> 9; docs/mcp are no longer part of the standard).
- Versioning standard: reconcile [Unreleased] against the last tag before
  promoting, and always show proposed entries to the user for approval.
- Update registry.py compliance/release text and list_repos types, build.py
  component descriptions, and rebuild the MCP bundle + lib/wiki HTML.

standards/wiki/04_development/02_releasing/index.html

@@ -636,7 +636,7 @@ and the tag is created on the merged commit.</p>
 <li>You know whether this is a <strong>breaking</strong>, <strong>feature</strong>, or <strong>fix</strong> release.</li>
 <li>The version file exists:</li>
 <li>package → <code>version</code> in <code>pyproject.toml</code></li>
-<li>service / site → <code>VERSION</code> at the repo root</li>
+<li>service → <code>VERSION</code> at the repo root</li>
 </ul>
 <hr />
 <h2 id="pick-the-next-version">🚦 Pick the next version</h2>
@@ -671,12 +671,22 @@ line (see the reference page); once at <code>1.0.0</code>, normal SemVer applies
 <hr />
 <h2 id="release-in-the-mr">🌿 Release in the MR</h2>
 <p>The version is known while the change is still a merge request, so the bump
-rides along with it. Do both edits <strong>in the MR</strong>:</p>
+rides along with it. Do all edits <strong>in the MR</strong>:</p>
 <ul>
-<li><strong>Promote the changelog</strong> in <code>CHANGELOG.md</code>: move the <code>[Unreleased]</code> content
-  under a new <code>## [x.y.z] - YYYY-MM-DD</code> heading, leave a fresh empty
-  <code>[Unreleased]</code> on top, and add the compare links — naming the <strong>version/tag</strong>,
-  never a commit id:</li>
+<li>
+<p><strong>Reconcile the changelog first.</strong> <code>[Unreleased]</code> is a <strong>draft, not the source
+  of truth</strong>: diff the change against the last tag
+  (<code>git log &lt;last-tag&gt;..HEAD</code>, <code>git diff --stat &lt;last-tag&gt;..HEAD</code>) and add an
+  entry for every user-facing change that is missing. <strong>Always show the proposed
+  additions to the user and wait for approval</strong> before promoting — ask rather
+  than guess when an entry is ambiguous.</p>
+</li>
+<li>
+<p><strong>Promote the changelog</strong> in <code>CHANGELOG.md</code>: move the (now reconciled)
+  <code>[Unreleased]</code> content under a new <code>## [x.y.z] - YYYY-MM-DD</code> heading, leave a
+  fresh empty <code>[Unreleased]</code> on top, and add the compare links — naming the
+  <strong>version/tag</strong>, never a commit id:</p>
+</li>
 </ul>
 <div class="language-markdown highlight"><table class="highlighttable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span><span class="normal"><a href="#__codelineno-0-1">1</a></span>
 <span class="normal"><a href="#__codelineno-0-2">2</a></span></pre></div></td><td class="code"><div><pre><span></span><code><span id="__span-0-1"><a id="__codelineno-0-1" name="__codelineno-0-1"></a>[<span class="nl">Unreleased</span>]: <span class="na">https://git.aetoskia.com/aetos/&lt;repo&gt;/compare/x.y.z...HEAD</span>
@@ -684,7 +694,7 @@ rides along with it. Do both edits <strong>in the MR</strong>:</p>
 </span></code></pre></div></td></tr></table></div>
 <ul>
 <li><strong>Bump the version file</strong> to the intended release version: <code>version = "x.y.z"</code>
-  in <code>pyproject.toml</code> (packages) or the <code>VERSION</code> file (services/sites).</li>
+  in <code>pyproject.toml</code> (packages) or the <code>VERSION</code> file (services).</li>
 </ul>
 <hr />
 <h2 id="tag-the-merged-commit">🏷️ Tag the merged commit</h2>
@@ -701,8 +711,8 @@ you confirm the MR is merged/squashed and tell it to proceed, the agent:</p>
 <li>Finds the commit that introduced the bump:</li>
 <li>package:
      <code>git log -S 'version = "x.y.z"' -n 1 --format='%H %s' -- pyproject.toml</code></li>
-<li>service / site:
-     <code>git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION</code></li>
+<li>service:
+      <code>git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION</code></li>
 <li>Verifies that commit's version file equals <code>x.y.z</code>, then tags <strong>only</strong> that
    commit: <code>git tag x.y.z &lt;sha&gt;</code>.</li>
 <li>Does <strong>not</strong> push — it asks you to run <code>git push origin x.y.z</code>.</li>
@@ -716,7 +726,6 @@ you confirm the MR is merged/squashed and tell it to proceed, the agent:</p>
 <li><strong>Type B (service):</strong> asserts <code>tag == VERSION</code>, resolves the tag, skips if the
   image already exists, runs the quality gate, builds, pushes, and restarts the
   container.</li>
-<li><strong>Type B (site):</strong> triggered on push, ships <code>:latest</code> and has no tag guard.</li>
 </ul>
 <p>If the guard fails, nothing is published — fix the version file, amend the
 commit, and move the tag <strong>only</strong> if it was never pushed.</p>