Adopt CalVer, starting at 2026.9.0

[vpetersson-bot]

What

Moves the integration to CalVer YYYY.M.MICRO, starting at 2026.9.0:
package.json, package-lock.json, and the release/version sections of the
developer documentation.

Why the two version fields had drifted

package.json and package-lock.json said 0.6.0 while the newest tag was
v0.6.1. Those two are not interchangeable:

• zapier push reads package.json — that is the version Zapier receives.
• The tag only triggers zapier-release.yml.

At v0.6.1, package.json still said 0.6.0 (git show v0.6.1:package.json),
so that release deployed 0.6.0 under a tag calling itself 0.6.1. Nothing
compares the two, so nothing reported it. The docs now say which source is
authoritative and in what order to change them.

What is not in this PR

A guard in zapier-release.yml that fails the deploy when the tag and
package.json disagree. I could not push it — the token I have lacks the
workflow scope. It is four lines, after the Set up Node.js step:

      - name: Verify tag matches package.json version
        run: |
          PKG=$(node -p "require('./package.json').version")
          if [ "${GITHUB_REF_NAME#v}" != "$PKG" ]; then
            echo "Tag $GITHUB_REF_NAME does not match package.json version $PKG"
            exit 1
          fi

Worth adding by someone who can — it is the only thing that would have caught
the v0.6.1 case at the time rather than a month later.

Releasing after this merges

git tag -a v2026.9.0 -m "New release"
git push origin v2026.9.0

Everything on master since v0.6.1 is security and dependency work
(puppeteer-core for CVE-2026-56876 and the extract-zip symlink traversal,
postcss, ip-address, smol-toml, markdownlint-cli) plus the Node floor raised to
match puppeteer-core@25's engine requirement. That last one is the only
behavioural change and it is a build-environment constraint, not a runtime one.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Reconcile the remaining semantic-versioning guidance in CONTRIBUTING.md with the CalVer workflow.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Update CONTRIBUTING.md to make CalVer release guidance consistent · New

What changed in this PR

Adopts CalVer 2026.9.0 and updates release/versioning guidance.

Changes:

• Updates package.json and package-lock.json.
• Documents CalVer tagging and package version authority.

File	Summary
package.json	Sets version to 2026.9.0.
package-lock.json	Synchronizes version metadata.
docs/​developer-documentation.md	Updates CalVer release guidance; conflicting semver guidance remains in CONTRIBUTING.md.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The only finding is a non-blocking documentation nit.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Update CONTRIBUTING.md to make CalVer release guidance consistent

Previously missed (1)

In code that hasn't changed since last review

Update stale release guidance from main to master

CONTRIBUTING.md:82

The release process still says approved PRs are merged to main at line 80, while the new release instructions and the repository's branch-filtered workflows use master (.github/workflows/test.yml:5, .github/workflows/lint.yml:5). Please update the stale branch reference so contributors do not follow conflicting release guidance.