fix(ci): use changesets/action to create tags and releases (#541)

* fix(ci): publish operator image and push tags explicitly

- Mark llama-agents-operator as non-private so the release pipeline
  includes its docker image in the publish plan.
- Replace 'git push --tags' (which silently reported 'Everything
  up-to-date' and left new tags on the local runner) with an explicit
  verbose push of the tags created by 'changeset tag' at HEAD.

* fix(ci): use changesets/action in publish mode for tags + releases

Replaces the bespoke 'changeset tag + git push' step with a
changesets/action call in publish mode. The publish script is
'pnpm exec changeset tag' — the fan-out jobs already handled the
real publishing. The action parses 'New tag: pkg@version' lines
from the publish output, pushes each tag, and creates a GitHub
Release populated from the package's CHANGELOG.md entry. This
restores the per-package release behavior that was in place before
the publish-pipeline refactor (#489) and also fixes the silent
'Everything up-to-date' tag-push regression.

* Update docker image publication details for arm

.changeset/large-poems-guess.md

@@ -0,0 +1,5 @@
+---
+"llama-agents-operator": patch
+---
+
+Publish llama-agents-operator arm images

.github/workflows/publish_changesets.yml

@@ -250,30 +250,22 @@ jobs:
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: publish-plan
-      - name: Create and push git tags
+      # Use changesets/action in publish mode to (1) tag each package
+      # at its current version, (2) push the tags, and (3) create a
+      # GitHub Release per tag with the CHANGELOG entry as the body.
+      # The ``publish`` script is a no-op beyond ``changeset tag`` —
+      # the fan-out jobs above handle the actual PyPI / Docker / Helm
+      # publishing. The action only parses ``New tag: ...`` lines from
+      # the publish script output to decide which packages to release.
+      - name: Create tags and GitHub releases
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1
+        with:
+          publish: pnpm exec changeset tag
+          setupGitUser: false
+          createGithubReleases: true
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -euo pipefail
-          echo "Existing tags at HEAD before changeset tag:"
-          git tag --points-at HEAD | sort || true
-
-          pnpm exec changeset tag
-
-          echo "Tags at HEAD after changeset tag:"
-          NEW_TAGS=$(git tag --points-at HEAD | sort)
-          echo "$NEW_TAGS"
-
-          if [ -z "$NEW_TAGS" ]; then
-            echo "No tags to push."
-            exit 0
-          fi
-
-          # Push each tag explicitly so failures surface instead of being
-          # hidden behind ``git push --tags`` silently reporting
-          # "Everything up-to-date" when the default push refspec drops
-          # tags that aren't reachable from tracked branches.
-          echo "$NEW_TAGS" | xargs -r git push --verbose origin
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
       - name: Extract published llama-agents-server version
         if: github.ref == 'refs/heads/main'