feat(standards): MR-based tag strategy + repository inventory (registry://repos)

Versioning standard now documents the MR flow: bump pyproject.toml/VERSION and promote CHANGELOG in the MR (referencing the version/tag, not a commit id), merge/squash, then tag the resulting commit. Adds the agent-assisted tagging procedure (wait for the go-ahead, find the version-bump commit, tag only it, ask the user to push) to both the reference page and the releasing wiki runbook. Adds the repo inventory (src/repos.json -> mcp/repos.json), the registry://repos resource + list_repos tool, the 15_repository_inventory lib page, and two MCP prompts: compliance (remediate repos) and release (agent tagging).

standards/src/wiki/04_development/02_releasing.md

@@ -5,14 +5,16 @@ page [Versioning & Changelog](../lib/11_versioning_and_changelog/); this is the
 runbook you follow.
 
 Every repository is one of two Drone shapes — a **PyPI package** or a **Docker
-deployment** ([Drone Pipelines](../lib/10_drone_pipelines/)). Both are
-released the same way: bump the version file, promote the changelog, tag.
+deployment** ([Drone Pipelines](../lib/10_drone_pipelines/)). Both release the
+same way: the version bump and changelog promotion go **in the merge request**,
+and the tag is created on the merged commit.
 
 ---
 
 ## 🧾 Before you start
 
-- `main` is green (the Drone quality gate passed on the last run).
+- You have an open **merge request** holding the change, and `main` is green
+  (the Drone quality gate passed on the last run).
 - You know whether this is a **breaking**, **feature**, or **fix** release.
 - The version file exists:
   - package → `version` in `pyproject.toml`
@@ -33,36 +35,46 @@ line (see the reference page); once at `1.0.0`, normal SemVer applies.
 
 ---
 
-## ✍️ Promote the changelog
+## 🌿 Release in the MR
 
-In `CHANGELOG.md`:
+The version is known while the change is still a merge request, so the bump
+rides along with it. Do both edits **in the MR**:
 
-1. Rename the content under `[Unreleased]` into a new
-   `## [x.y.z] - YYYY-MM-DD` heading (keep the sections that apply).
-2. Leave a fresh, empty `## [Unreleased]` on top.
-3. Add the compare links at the bottom:
+- **Promote the changelog** in `CHANGELOG.md`: move the `[Unreleased]` content
+  under a new `## [x.y.z] - YYYY-MM-DD` heading, leave a fresh empty
+  `[Unreleased]` on top, and add the compare links — naming the **version/tag**,
+  never a commit id:
 
-   ```markdown
-   [Unreleased]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.z...HEAD
-   [x.y.z]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.(z-1)...x.y.z
-   ```
+  ```markdown
+  [Unreleased]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.z...HEAD
+  [x.y.z]: https://git.aetoskia.com/aetos/<repo>/compare/x.y.(z-1)...x.y.z
+  ```
+
+- **Bump the version file** to the intended release version: `version = "x.y.z"`
+  in `pyproject.toml` (packages) or the `VERSION` file (services/sites).
 
 ---
 
-## 🔢 Bump the version file
+## 🏷️ Tag the merged commit
 
-- **Package:** edit `version = "x.y.z"` in `pyproject.toml`.
-- **Service / site:** edit the `VERSION` file.
+1. **Merge or squash** the MR into `main`.
+2. **Create the tag** on the resulting commit: `git tag x.y.z` (lightweight).
+3. **Push the tag** (`git push origin x.y.z`) — Drone builds the release.
 
-Then commit and tag:
+### 🤖 Agent-assisted tagging
 
-```bash
-git add CHANGELOG.md pyproject.toml   # or VERSION
-git commit -m "chore(release): x.y.z"
-git tag x.y.z
-git push origin HEAD
-git push origin x.y.z
-```
+The agent does not author or merge the MR and never tags before the merge. After
+you confirm the MR is merged/squashed and tell it to proceed, the agent:
+
+1. Waits for that explicit go-ahead.
+2. Finds the commit that introduced the bump:
+   - package:
+     `git log -S 'version = "x.y.z"' -n 1 --format='%H %s' -- pyproject.toml`
+   - service / site:
+     `git log -S 'x.y.z' -n 1 --format='%H %s' -- VERSION`
+3. Verifies that commit's version file equals `x.y.z`, then tags **only** that
+   commit: `git tag x.y.z <sha>`.
+4. Does **not** push — it asks you to run `git push origin x.y.z`.
 
 ---