fix(release): stop the coana bump from hand-writing versions

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

The bump-coana skill bumped package.json's version itself and wrote its own ## [<version>] changelog heading. Both belong to the release workflow, and the skill's versions of them caused real damage on v1.x:

• Changelog headings for 1.1.160, a version with no tag, no GitHub release, and nothing on npm — written twice, by upgrading coana to version 15.10.17 #1502 and upgrading coana to version 15.10.23 #1510.
• v1.1.159 shipped with empty notes. upgrading coana to version 15.10.16 #1501's hand-written heading consumed the ## [Unreleased] block, so when the real release ran it found nothing to promote.
• The first 1.1.160 release attempt failed outright: with the manifest already hand-written to 1.1.160, writeManifestVersion's rewrite was byte-identical, and its replaced === raw guard reported "no top-level version line" against a manifest whose version field was present and well-formed.

Changes

.claude/skills/bump-coana/SKILL.md

• Step 2 no longer touches the top-level version, and says why: the release owns that field, and hand-writing it breaks the next release.
• Step 3 adds the entry under ## [Unreleased], recreating the heading when the previous release consumed it. Having nowhere to put notes is what motivated the invented headings, so the fix has to cover that case or it will recur.
• Explicit "never write a ## [<version>] heading", plus a matching line under Important Notes.

scripts/release/bump.mts

• Separate the two failures the old guard conflated: test for the version field, then replace. A manifest already holding the target version now passes through as a no-op instead of failing the release. The base comes from release tags and the registry, never the manifest, so an already-correct manifest is not a reason to stop.

test/release-bump.test.mts

• Add the missing no-op case. Verified against the old implementation: it throws on this input, the new one does not, and both the missing-field and empty-version cases still throw.

Verification

• pnpm run lint — 0 errors
• pnpm run check:tsc — clean, both projects
• pnpm test:unit test/release-bump.test.mts — 5/5

No changelog entry: internal tooling, excluded per the repo's changelog rules.

Follow-up not included here

Step 5 still commits with git commit -n, which skips the commit-msg PII guard that CLAUDE.md says not to work around. Left alone since the intent was probably to skip the pre-commit lint hook — DISABLE_PRECOMMIT_LINT=1 would do that without disarming the guard.

---

Note

Medium Risk
Changes the release bump script on the npm-publish path; the fix is narrow but release infrastructure is sensitive.

Overview
Stops the bump-coana skill from editing release-owned metadata and hardens the CI release bump when package.json already matches the derived version.

The skill now only bumps @coana-tech/cli in devDependencies, logs Coana changes under ## [Unreleased] (recreating that section if a release consumed it), and explicitly forbids touching the top-level version or adding ## [<version>] changelog headings—behavior that had invented unreleased versions and left real releases with empty notes.

writeManifestVersion in scripts/release/bump.mts checks for a version field before replacing, so a manifest already at the target version is a no-op instead of throwing “no version line.” A unit test covers that case.

^{Reviewed by Cursor Bugbot for commit 4a42956. Configure here.}