Write and enforce the semver policy, per operator ruling on 1.0.60

1.0.60 removed public API (CultInspectorAssetPath) under a patch bump; its
own changelog says "Breaking" and the version number lied. Operator ruling:
semver is policy, strictly, for every published package family.

docs/semver-policy.md states what counts as breaking per surface (managed
API, Unity inspector attributes, CultCache wire format/store compatibility,
CultNet protocol, native bridge exports), the 0.y.z pre-1.0 convention, tag
naming, and required changelog shape. Records the 1.0.60 scar as history;
does not renumber it.

scripts/check-changelog-semver.mjs is the mechanical check: refuses a
changelog "### Breaking" section under too small a bump, and refuses a
version that skips, reverses, or repeats the previous published tag. Skips
re-litigating a version that is already tagged (rebuilding immutable
history is not a release action). Wired into publish-packages.yml for the
four npm/PyPI packages, and into build-unity-package.ps1 (cultlib),
packages/cultmath/scripts/build-unity-package.ps1 (cultmath), and a new
scripts/verify-caching-unity-release.ps1 (caching.unity has no build script
of its own to hook into).

18 node:test cases cover the required table (breaking+major/minor/patch,
non-breaking, 0.y.z, skip, downgrade) plus CLI-level git-tag resolution.
Hand-mutated each rule (bump classification, pre-1.0 lane requirement,
breaking-heading detection, breaking early-return, already-published skip)
and confirmed each kill, then restored byte-exact. No mutation harness is
committed; CultLib has none today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/publish-packages.yml

@@ -42,8 +42,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
+      # fetch-depth: 0 so the semver check below can see every previously
+      # published tag, not just the one that triggered this run.
       - name: Check out CultLib
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -64,6 +68,19 @@ jobs:
             exit 1
           fi
 
+      # docs/semver-policy.md: a breaking change under too small a bump, or a
+      # version that skips or reverses the previous release, fails here
+      # instead of shipping with a number that lies.
+      - name: Verify semver policy
+        if: startsWith(github.ref, 'refs/tags/cultcache-ts-v')
+        run: |
+          tagged="${GITHUB_REF_NAME#cultcache-ts-v}"
+          node scripts/check-changelog-semver.mjs \
+            --package "@gamecult/cultcache-ts" \
+            --changelog packages/cultcache-ts/CHANGELOG.md \
+            --version "$tagged" \
+            --tag-prefix cultcache-ts
+
       - name: Build and test
         working-directory: packages/cultcache-ts
         run: npm test
@@ -105,9 +122,13 @@ jobs:
             echo "run=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # fetch-depth: 0 so the semver check below can see every previously
+      # published tag, not just the one that triggered this run.
       - name: Check out CultLib
         if: steps.selected.outputs.run == 'true'
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Set up Python
         if: steps.selected.outputs.run == 'true'
@@ -115,6 +136,12 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Node
+        if: steps.selected.outputs.run == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+
       - name: Verify the tag matches the manifest version
         if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
         run: |
@@ -125,6 +152,19 @@ jobs:
             exit 1
           fi
 
+      # docs/semver-policy.md: a breaking change under too small a bump, or a
+      # version that skips or reverses the previous release, fails here
+      # instead of shipping with a number that lies.
+      - name: Verify semver policy
+        if: steps.selected.outputs.run == 'true' && startsWith(github.ref, 'refs/tags/')
+        run: |
+          tagged="${GITHUB_REF_NAME#${{ matrix.package }}-v}"
+          node scripts/check-changelog-semver.mjs \
+            --package "${{ matrix.package }}" \
+            --changelog packages/${{ matrix.package }}/CHANGELOG.md \
+            --version "$tagged" \
+            --tag-prefix "${{ matrix.package }}"
+
       # Lower layers install from source so a release of one package is tested
       # against the sibling revision it was cut with, not whatever PyPI has.
       - name: Install and test