feat(standards): add versioning + changelog standard, release templates, and Drone version guard

Add lib page 11 (SemVer contract, pre-1.0 rule, tag==version invariant, Keep a Changelog), the releasing wiki runbook, and canonical release templates (CHANGELOG.md, VERSION). Vendor them into the MCP bundle as templates/release + release.json and expose registry://release with list/get tools. Add a changelog component to the app template. Enforce the tag<->version contract in both Drone shapes: Type A check-version and the backfill loop verify pyproject version; Type B adds a VERSION guard step.

standards/mcp/templates/drone/service-docker.yaml

@@ -20,6 +20,10 @@
 #   <host-port>      published host port; <container-port> the in-image port.
 #   <site>           site image name for the site variant (e.g. docs, mcp).
 #   <env-var>        runtime environment variable consumed by the service.
+#
+# Version guard: the tag-triggered service variant fails unless the git tag
+# equals the repo-root VERSION file (see the versioning standard). The
+# push-triggered site variant ships :latest only and has no version to guard.
 ---
 kind: pipeline
 type: docker
@@ -64,6 +68,22 @@ steps:
           exit 1
         fi
 
+  - name: check-version
+    image: alpine:3.20
+    commands:
+      - VERSION=$(cat VERSION 2>/dev/null | tr -d '\n')
+      - echo "tag=$DRONE_TAG version=$VERSION"
+      - |
+        if [ -z "$VERSION" ]; then
+          echo "VERSION file missing or empty; add it (see versioning standard)."
+          exit 1
+        fi
+      - |
+        if [ "$DRONE_TAG" != "$VERSION" ]; then
+          echo "Tag '$DRONE_TAG' does not match VERSION '$VERSION'; refusing to deploy."
+          exit 1
+        fi
+
   - name: check-remote-image
     image: docker:24
     volumes: