Switch release-plz workflow back to upstream action once PR #2789 merges

Background

In commit a4d343a6 we replaced release-plz/action@v0.5 with a custom workflow that installs release-plz from a fork pinned to PR release-plz#2789 (commit e8ca8da97dc8f472820a67eece651604887b1c7d on structured-world/release-plz).

This was necessary because upstream release-plz 0.3.157 (latest as of 2026-05) crashes the release-pr job with "no matching package named X found, location searched: crates.io index". Root cause: cargo package's prepare_for_upload step queries crates.io for every dep, which fails for our publish = false internal libs (right-core, right-db, right-mcp, right-codegen, right-memory). This is upstream issue release-plz#2595 — Case 2/B.

PR #2789 fixes this by falling back to source-directory comparison when cargo package fails in git_only mode. Multiple users in the PR thread confirmed the fork branch works for their monorepos. The PR has been open since 2026-04-12 with all CI checks passing, awaiting maintainer review.

Cost of the workaround

• Each release-plz workflow run compiles release-plz from source. ~5-8 min with Swatinem/rust-cache, longer cold.
• Supply-chain expansion: a third-party fork pinned to a SHA. Mitigated by SHA pinning, but still a maintenance trap.
• Lost the action's output parsing (PR URLs etc.). Not consumed downstream, so harmless today.

Definition of done

When release-plz#2789 merges and a release-plz version containing the fix ships (and release-plz/action releases a new tag bundling that version):

1. Revert .github/workflows/release-plz.yml to use release-plz/action@<new-version> with the per-step env: GITHUB_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}.
2. Verify both Release-plz release and Release-plz PR jobs still pass on a real push.
3. Verify humanize-changelog still triggers on the release PR (filter uses head.ref prefix in humanize-changelog.yml, should still work).
4. Close this issue.

Watch list

• release-plz#2789 — the actual fix.
• release-plz#2595 — tracking issue.
• release-plz/action releases — for the version bump that includes the fixed release-plz.

Wait for release-plz#2789 and a release-plz/action tag containing its fix, then inspect .github/workflows/release-plz.yml and the head.ref filter in humanize-changelog.yml. Restore the upstream action with the per-step token environment, verify both release and PR jobs on a real push, and confirm humanize-changelog still triggers.