Recover abandoned Changesets signing helper refs before release updates #547

Updating the generated Version Packages PR can fail even though changeset-release/main is explicitly exempt from the organization's non-fast-forward rule.

Release run https://github.com/transloadit/node-sdk/actions/runs/37736494496 failed in attempts 1 and 2 while refreshing #544 after the approved alphalib sync and Assembly reader corrections. GitHub reported Cannot force-push to this branch; the rule-suite record identifies the actual ref as refs/heads/changesets-ghcommit-temp/changeset-release/main.

The pinned Changesets action uses @changesets/ghcommit 2.1.1 to create signed commits. For an existing release branch, that helper creates a temporary branch and force-resets it when a prior temporary branch already exists. The organization's rule excludes refs/heads/changeset-release/*, but deliberately keeps the temporary namespace under its normal force-push protection.

The abandoned temporary ref pointed at f8d757414a8470f277b0e49b9564602dcafb3d1f, a verified github-actions[bot] Version Packages commit from July 11. Its diff contains only changeset removals, package versions, changelogs and the lockfile. No current release job was active. Its commit was fetched and preserved locally, then only this stale bot artifact was deleted before rerunning the latest main workflow. The real Version Packages branch and PR were retained, and no repository or organization rules were weakened.

Improve release preflight/recovery and CONTRIBUTING.md so a plain rerun cannot repeatedly hit this opaque error. Consider a bounded cleanup of a verified abandoned bot temporary ref under the existing serialized Release workflow, or at least emit its exact name, commit and safe operator procedure. Refuse unexpected source changes or active release work. Preserve signed commits and the human review/green-CI gate for Version Packages. Add behavioral tests for the clean path, a stale generated helper ref, and refusal to remove non-generated or concurrent work.

The source behavior is in https://github.com/changesets/ghcommit/blob/v2.1.1/src/core.ts (temporary-ref recovery in commitFilesFromBase64).