Stability checkpoint — release-please removal + CI hardening

Waves landed since stable-v1.0.38 (2026-04-23) :

- release-please removed entirely (MR !102) — replaced by bin/ship/
  shell scripts (changelog.sh + gitlab-release.sh). Zero node_modules
  added, zero CI runner burn per tag. Mirror of svc !169.
- grype bumped v0.87.0 → v0.111.0-debug (MR !103) — multi-arch +
  ships /bin/sh (the non-debug variant broke with "exec: sh not found").
- e2e:kind /actuator/health wait bumped 120s → 10min (MR !104) —
  cold mvn compile + Spring Boot startup takes 2-5 min under runner
  pressure ; old ceiling aborted before compilation finished.
- workflow:rules allowlist covers `.gitlab-ci/**/*` (MR !105) — Phase
  B-4 include files now trigger CI.
- bin/ship/changelog.sh bug fix (MR !106) — mirror of svc !171 :
  set -e + `[ 0 -eq 1 ]` was killing the script on chore/ci/build/
  style commits when --include-chore was off.

Post-merge main pipeline #405 green on SHA 322dc5b (MR !105 merge).
MR !106 merged after (bin/ is out of UI workflow allowlist by design)
— changelog.sh fix is local tooling, not production code.