[release] Gate publishable 0.0.0 packages and missing changelogs

[kang-heewon]

Problem

Several publishable packages still have version: "0.0.0" and/or no package changelog. The release process relies on changesets for versioning, but there is no explicit pre-release gate that blocks placeholder package metadata before publish.

Evidence

• scripts/normalize-packages.mjs states that package versions are never changed there because changesets owns versioning.
• Root package.json release scripts use changesets, but manifest normalization does not fail on publishable 0.0.0 packages or missing changelogs.
• Current publishable examples include @croco/admin-core, @croco/admin-generated, @croco/admin-react, @croco/governance-core, @croco/idempotency-core, @croco/lifecycle-core, @croco/webhooks-core, and @croco/workflow-core with 0.0.0 metadata and/or missing changelogs.

Desired outcome

A release-facing check prevents placeholder package metadata from reaching a publish path, without manually bumping versions outside changesets.

Acceptance criteria

• Add a release metadata check that reports publishable packages with 0.0.0 versions and missing CHANGELOG.md files.
• Private packages and explicitly non-published tooling are excluded by rule, not by omission.
• The check explains the changesets-based recovery path instead of recommending manual version edits.
• The release workflow or pnpm check runs the gate before publish-sensitive steps.