chore: set up release-please, bump Node to >=21, disable darwin-x64 npm builds

[StefanSteiner]

Set up release-please, bump Node floor to >=21, disable darwin-x64 npm

Summary

Replaces the manual release process with release-please automation, raises the Node.js floor from >= 18 to >= 21, and turns off the currently-unreliable darwin-x64 npm publishing path.

No package versions change in this PR — everything stays at 0.1.1. The merge commit prefix is chore: so release-please will not auto-open a release PR after this lands. The first release PR will appear after the next feat: or fix: commit hits main.

What changes

release-please pipeline

• .github/workflows/release-please.yml (new) — runs release-please-action@v4 on every push to main using the default GITHUB_TOKEN. Maintains a single open "release PR" that bumps versions and updates per-crate CHANGELOG.md files based on Conventional Commits.
• release-please-config.json — declares all 15 components: 7 publishable packages (6 Rust + hyperdb-api-node) plus 8 npm platform sub-packages (3 for hyperdb-mcp, 5 for hyperdb-api-node after disabling darwin-x64). The linked-versions plugin groups them so they bump in lockstep, which keeps cargo publish's strict inter-crate version = "=X.Y.Z" pins consistent without manual edits.
• .release-please-manifest.json (new) — starting state, all 15 entries at 0.1.1.
• .github/workflows/release.yml — added on: release: types: [published] trigger so it fires when release-please publishes the GitHub Release. release-please uses GITHUB_TOKEN, and tags pushed by GITHUB_TOKEN don't fire on: push: tags: workflows. The release: published event isn't subject to that restriction (same pattern npm-build-publish.yml already uses), so this avoids needing a custom PAT. Tag-resolution step now also reads github.event.release.tag_name.

Node.js floor: >= 18 → >= 21

Older Node releases ship npm/npx versions that don't accept the npx -y <package> argument shape used in our MCP config examples (observed on Windows with bundled Node 14, but conservative enough to cover stale Node 18 installs too).

• 13 package.json files: engines.node updated.
• 4 doc files (hyperdb-api-node/README.md, AGENTS.md, DEVELOPMENT.md, examples/hyper-explorer/README.md).
• hyperdb-mcp/README.md — added a "Requirement: Node.js v21 or later" callout above the npm install command, plus a new "Upgrading Node.js with nvm" subsection covering macOS/Linux and Windows.

darwin-x64 npm builds disabled

The macos-13 GHA runner has been unreliable, blocking darwin-x64 builds. Until the runner stabilizes, Intel macOS users must build from source.

• napi.targets (in hyperdb-api-node/package.json): removed x86_64-apple-darwin.
• optionalDependencies (in both hyperdb-api-node/package.json and hyperdb-mcp/npm/package.json): removed the *-darwin-x64 entries.
• Runtime loaders (hyperdb-api-node/index.js and hyperdb-mcp/npm/bin.js): return null for darwin-x64 so users get the existing "platform not supported" error path instead of a confusing "package not found" failure.
• release-please-config.json and manifest: removed the two *-darwin-x64 components.
• Docs (root README, hyperdb-mcp README, hyperdb-api-node README/AGENTS.md/DEVELOPMENT.md, GITHUB_OPERATIONS.md): platform tables updated; explicit notes added about Intel-Mac users building from source.
• npm-build-publish.yml matrix: already had darwin-x64 commented out before this PR; left alone.

The hyperdb-mcp/npm/darwin-x64/ and hyperdb-api-node/npm/darwin-x64/ directories are still on disk and git-tracked but no longer referenced anywhere — they can be re-enabled in place by reverting this PR's removals when macos-13 runners stabilize.

Documentation rewrites

• CONTRIBUTING.md → "Release Process" — replaced the manual "bump versions, edit changelogs, push tags" recipe with the release-please flow (write conventional commits, merge the release PR, done). Contributors no longer touch CHANGELOG.md or version fields by hand. Also unchecked the Contribution Checklist boxes (template state) and added a callout for multi-account contributors to use --local instead of --global when configuring SSH commit signing.
• docs/GITHUB_OPERATIONS.md — workflows table now lists release-please. "Cutting a release" rewritten around release-please. Added a new "How commits drive version bumps" subsection with a table mapping commit prefixes (fix:, feat:, feat!:, Release-As:) to version impact, with explicit handling of the pre-1.0 caveat (semver allows breaking changes within 0.x.y without a major bump). "Re-running" / "When something breaks" sections updated. Removed stale "Pre-built binaries" subsection (we no longer ship binary archives — those were dropped earlier when the build-binaries job was removed).
• README.md — replaced "Pre-built binaries" section with current install paths via npm install -g hyperdb-mcp and cargo install hyperdb-mcp. README badges already updated in an earlier commit on this branch.

Iceberg surfaced in the user-facing MCP README

While reviewing changes, noticed that Apache Iceberg support has been fully implemented (lakehouse.rs, load_iceberg MCP tool, iceberg export format, all using hyperd's native reader — no experimental flag) but never made it into hyperdb-mcp/README.md. Added it to:

• the "Why" intro (export targets)
• the "Features" list (input + output)
• a new load_iceberg tool entry under "Workspace Tools"
• the export format list

CHANGELOG one-time prep

All 7 CHANGELOG.md files: a ## [0.1.1] - 2026-05-13 heading was inserted between the existing ## [Unreleased] heading and its content, so the existing changelog body now sits under [0.1.1]. release-please starts from a clean [Unreleased] and will insert future release entries above the dated [0.1.1] section.

Doc fixes surfaced during review

• docs/GITHUB_OPERATIONS.md — fixed CRATES_IO_TOKEN → CARGO_REGISTRY_TOKEN (matches actual workflow secret name).
• docs/GITHUB_OPERATIONS.md — fixed crates.io publish order to match release.yml (hyperdb-api-salesforce first to break the optional-dep cycle, then hyperdb-api-core).
• hyperdb-api-node/README.md — fixed inconsistent Node.js >= 18 (rest of file already said >= 21).
• hyperdb-api-node/DEVELOPMENT.md — replaced stale "Publishing to npm" section (described a release:-prefixed commit flow that doesn't exist) with a pointer to release-please docs.

How to verify after merge

1. Push some conventional-commit PR (e.g. fix: or feat:) to main.
2. Confirm release-please opens a release PR titled chore(main): release X.Y.Z.
3. Inspect the PR diff. Specifically check:
   • Cargo.toml files: version = "X.Y.Z" updated, inter-crate version = "=X.Y.Z" pins updated.
   • hyperdb-api-node/package.json and hyperdb-mcp/npm/package.json: both their own version field AND every entry in their optionalDependencies block updated.
   • All 8 platform sub-packages: version field updated.
   • All 7 CHANGELOG.md files: a new ## [X.Y.Z] section above the existing ## [0.1.1] section, summarizing the conventional commits.
4. If anything in step 3 looks wrong, do not merge — the release-please config can be tweaked and the PR will regenerate on the next push to main.
5. When ready to release for real, merge the release-please PR and confirm both release.yml (crates.io) and npm-build-publish.yml (npm) fire automatically and publish successfully.

Test plan

• cargo check --workspace --exclude hyperdb-api-node passes (verified locally)
• cargo fmt --all --check clean
• CI green on this PR (only touches config + docs + JS loaders, no Rust test logic)
• After merge: push a conventional commit and observe the release-please PR
• First production release: merge the release-please PR and confirm both downstream workflows fire and complete

Out of scope

• Root package.json still has file: deps pointing to nonexistent 0.1.0.tgz artifacts. Pre-existing since the OSS release, unrelated to this branch — separate cleanup.
• Re-enabling darwin-x64 npm builds when macos-13 GHA runners stabilize — separate revert-style PR.
• Wiring up Apple Developer ID code signing for darwin builds — was mentioned in the previous GITHUB_OPERATIONS.md as a future task; that note was removed since we no longer ship signed binary archives.