feat: better changelogs

[r0b1n]

• Explain that no changelogs are needed for shared
• Add private flag for shared packages
• Improve changelog checking tool to simulate merge and catch merge conflicts better

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
AGENTS.md	Clarified that changelogs are required for widgets/modules only, not shared packages
automation/utils/bin/rui-check-changelogs.ts	Reworked to simulate a 3-way merge via git merge-tree --write-tree before checking CHANGELOG validity; now also detects conflict markers
packages/shared/*/package.json (×13)	Added "private": true to all shared packages; one also gained "license": "Apache-2.0"

Skipped (out of scope): pnpm-lock.yaml, dist/

---

Findings

⚠️ Low — hasConflictMarkers only checks two of the three conflict-marker patterns

File: automation/utils/bin/rui-check-changelogs.ts line 121
Note: The helper checks for <<<<<<< and >>>>>>> but not for =======, the separator between conflicting hunks. A file that has the separator without the surrounding markers (edge case, but possible with custom merge drivers) would slip through. More importantly, omitting the check for ======= is slightly asymmetric. No blocking risk for the current use-case, but worth aligning:

function hasConflictMarkers(content: string): boolean {
    return content.includes("<<<<<<<") || content.includes("=======") || content.includes(">>>>>>>");
}

⚠️ Low — git merge-tree --write-tree is Git ≥2.38; minimum Git version is not documented

File: automation/utils/bin/rui-check-changelogs.ts line 79
Note: The --write-tree flag was introduced in Git 2.38 (Oct 2022). If any CI runner or developer machine has an older Git, the script will fail with a confusing error. Consider adding a version check at the top of main(), or documenting the minimum Git version requirement in a comment.

---

Positives

• The shift from git diff base...head (three-dot, symmetric diff) to a simulated merge tree is the correct approach for a changelog guard — it catches the real conflict scenario (both sides touched the same file) rather than just "this file was changed in the PR."
• Marking all packages/shared/* packages as "private": true directly enforces the updated AGENTS.md rule that shared packages don't need changelogs — a clean policy-meets-tooling alignment.
• Conflict-marker detection is a nice defensive addition; previously a CHANGELOG with unresolved markers would have silently passed parsing.
• AGENTS.md update is concise and accurate — the single line change precisely captures the new rule.