chore: propagate main into development

.github/renovate.json

@@ -7,6 +7,8 @@
     "helpers:pinGitHubActionDigests"
   ],
   "baseBranchPatterns": ["development"],
+  "semanticCommitType": "deps",
+  "semanticCommitScope": null,
   "postUpdateOptions": ["npmDedupe"],
   "skipInstalls": false,
   "timezone": "America/New_York",
@@ -35,6 +37,11 @@
       "groupName": "github-actions-non-major",
       "groupSlug": "github-actions-non-major"
     },
+    {
+      "description": "GitHub Actions bumps are CI-only — they don't change the bundled extension, so keep them as chore: (non-releasable) rather than deps: (cuts a release).",
+      "matchManagers": ["github-actions"],
+      "semanticCommitType": "chore"
+    },
     {
       "description": "Group npm non-major updates into one PR",
       "matchManagers": ["npm"],

CLAUDE.md

@@ -16,6 +16,24 @@ the `propagate-main-to-development` workflow. `promote-dev-to-main` opens a
 weekly PR the other direction once `development`'s CI is green. release-please
 drives versioning and publishing off Conventional Commit prefixes on `main`.
 
+Commit-prefix conventions (applies to PR titles, and to local commits so a
+bundled promotion still parses):
+
+- `deps:` for any dependency bump — Renovate emits this automatically
+  (`.github/renovate.json` → `semanticCommitType: deps`). It cuts a patch
+  release and lands in the changelog's "Dependencies" section, which is the
+  point: a vuln fix in a bundled dependency should ship a new version.
+- `chore:` for dependency bumps that don't affect the bundled extension —
+  GitHub Actions digest pins, CI-only tooling. Non-releasable by design.
+- `ci:` for `.github/workflows/*`, `build:` for build-tooling changes that
+  aren't dep bumps, `docs:` for docs-only. All non-releasable.
+- `feat:` / `fix:` for actual product changes, as normal.
+- Only `feat:`, `fix:`, `perf:`, `deps:`, and breaking changes (`!` /
+  `BREAKING CHANGE:`) trigger a release — `release-please-config.json` →
+  `changelog-sections` defines the set (a type listed there without
+  `"hidden": true` is release-triggering; that's why `deps` bumps a version
+  and `chore`/`ci` don't).
+
 ## Definition of Done
 
 Every change is expected to clear this bar before it's mergeable:

release-please-config.json

@@ -3,6 +3,20 @@
   "release-type": "node",
   "pull-request-header": "Here's what's new in Workspace File Bookmarks",
   "pull-request-footer": "Merge this PR to cut the release.",
+  "changelog-sections": [
+    { "type": "feat", "section": "Features" },
+    { "type": "fix", "section": "Bug Fixes" },
+    { "type": "perf", "section": "Performance Improvements" },
+    { "type": "deps", "section": "Dependencies" },
+    { "type": "revert", "section": "Reverts" },
+    { "type": "docs", "section": "Documentation", "hidden": true },
+    { "type": "style", "section": "Styles", "hidden": true },
+    { "type": "chore", "section": "Miscellaneous", "hidden": true },
+    { "type": "refactor", "section": "Code Refactoring", "hidden": true },
+    { "type": "test", "section": "Tests", "hidden": true },
+    { "type": "build", "section": "Build System", "hidden": true },
+    { "type": "ci", "section": "Continuous Integration", "hidden": true }
+  ],
   "packages": {
     ".": {
       "draft": true,