ci: rebuild release-creator without a third-party action

[abueide]

Summary

release-creator.yml (opens the "Version Packages" PR whenever changesets are pending) has been failing with startup_failure since 2026-07-15 - changesets/action is a third-party GitHub Action, blocked by this org's Actions allowlist (allowed_actions: "selected", GitHub-owned only - same root cause as the codecov/codecov-action fix in #1377).

This went unnoticed because the workflow doesn't block anything directly - it just silently never opened a PR. There was a real pending changeset (the js-cookie security fix) stuck with no way to ship; that shipped by hand as a one-off PR (#1378) to unblock it while this fix was built properly.

What changed

Replaced the action with plain run: steps + the gh CLI:

1. Detect pending changesets (any .changeset/*.md besides README.md)
2. If none: close a stale release PR if one's still open (nothing to release)
3. If some: reset the changeset-release/master branch to current master, run the existing yarn update-versions-and-changelogs script (unchanged - this is the same command the action was already calling), commit as "Version Packages", force-push
4. Create the PR if one isn't already open for that branch (or let the push update the existing one)

No third-party uses: action anywhere in the file - only actions/checkout and actions/setup-node (both GitHub-owned).

Test plan

• YAML/actionlint validated
• yarn scripts lint passes
• Merge and confirm the next changeset-triggering push actually opens/updates a real PR end-to-end (can't fully simulate the push-triggered flow locally)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 50e4870

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[tvs-twilio-segment]

✅ TVS Validation Passed

View full report

Show details

All validation checks have successfully completed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.59%. Comparing base (5cf2f1a) to head (2bad2a7).
⚠️ Report is 2 commits behind head on master.

⚠️ Current head 2bad2a7 differs from pull request most recent head 50e4870

Please upload reports for the commit 50e4870 to get more accurate results.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1379   +/-   ##
=======================================
  Coverage   91.59%   91.59%           
=======================================
  Files         127      127           
  Lines        4142     4142           
  Branches     1033     1033           
=======================================
  Hits         3794     3794           
  Misses        348      348           

Flag	Coverage Δ
browser	92.51% <100.00%> (ø)
core	90.07% <ø> (ø)
node	89.43% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.