Restore lockstep release: add missing service-cluster packages to changesets fixed + CI guard

[Copilot]

@objectstack/service-cluster and @objectstack/service-cluster-redis were absent from fixed in .changeset/config.json, so the last release bumped them out of lockstep with the rest of @objectstack/*. Nothing prevented this drift from happening again the next time a public package is added.

Fix

• Add both packages back into the fixed group; the workspace now has 60/60 public packages covered.

Guard against recurrence

• scripts/check-changeset-fixed.mjs — zero-dependency validator. Reads pnpm-workspace.yaml, enumerates every non-private package.json, and diffs against fixed. Reports both missing names (new package not enrolled) and stale names (renamed/deleted package still listed). Non-zero exit on drift.
• package.json — exposed as pnpm run lint:changeset for local use.
• .github/workflows/validate-deps.yml — runs the validator on PRs touching **/package.json, pnpm-workspace.yaml, .changeset/config.json, or the script. Fast feedback before merge.
• .github/workflows/release.yml — runs the validator before pnpm run build / changeset publish. Final gate so a release cannot ship while the group is out of sync.
• CHANGELOG.md — entry under [Unreleased].

Why a custom script and not @changesets/*

Changesets has no built-in "all public packages must be in a fixed/linked group" lint. The script is ~140 LOC, has no runtime deps, and runs before pnpm install, so it adds no dependency surface and works on a cold CI runner.

Failure output (verified locally)

✗ .changeset/config.json "fixed" group is out of sync.
Public packages missing from "fixed" (add them to keep versions in lockstep):
- @objectstack/service-cluster
Names in "fixed" that no longer exist in the workspace (remove them):
- @objectstack/no-such-package

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	May 25, 2026 9:28am