feat(overlay-release): SemVer releases from conventional commits

[poysama]

Switches the overlay-release reusable from CalVer (vYYYY.MM.DD.<run_number>) to SemVer derived from conventional-commit subjects since the last SemVer tag. This is Subsystem 1 of the console-owned overlay-pins effort (tag/SemVer-based releases the console will later promote).

What changes

• scripts/compute-next-semver.sh . pure, dependency-free bash. Reads commit subjects on stdin, takes the current version as an arg, prints the next MAJOR.MINOR.PATCH or nothing. Bump mapping mirrors core's auto-changeset.yml exactly (verified against the real file): type!:/type(scope)!: → major, feat → minor, fix/perf/refactor → patch, everything else ignored. Base-10 arithmetic is pinned so leading-zero segments never fall into octal.
• scripts/tests/compute-next-semver.test.sh . dependency-free harness (no bats/jq), runs the script as a subprocess and asserts stdout + exit code. 22/22 passing.
• .github/workflows/scripts-ci.yml . runs those tests on PRs touching scripts/**.
• .github/workflows/overlay-release.yml . rewritten. On a caller's push to main it checks out the overlay (full history + tags), checks out this repo's scripts/ at github.job_workflow_sha (so script and workflow are always the same pinned version), finds the highest strict-SemVer tag (legacy CalVer vYYYY.MM.DD.N tags are excluded and left in place), and pipes git log <lastTag>..HEAD --pretty=%s through the script to decide the next tag + GitHub Release. No-ops cleanly when nothing is release-worthy.

Merge notes

Baseline v0.1.0 tags still need to be seeded on the 6 overlays to enable releases (they sit at package.json 0.1.0 with only CalVer tags today). As a safety net this PR makes the workflow no-op on any overlay that has no SemVer baseline tag, so merging before the baselines are seeded is inert, not dangerous . releases simply will not fire until a baseline exists. The tag_prefix input (default v), GITHUB_TOKEN contents:write auth, and the vars.RUNNER_LABEL runner are unchanged.

Reviewed via a fresh whole-branch review (bump mapping confirmed against core, cross-repo checkout, set -euo pipefail / no-op safety, and the CalVer-exclusion filter all traced). Dry-run against real overlay history (b4m-libreoncology, b4m-bob) produced the expected results.