chore: release-please opens release PRs for the Go module and npm packages

[giraffesyo]

Summary

Replaces hand-tagging (Go) and hand-bumping (npm) with release-please, from the conventional-commit PR titles pr-title.yml already enforces.

• release-please-config.json: the root Go module (tags vX.Y.Z, no component prefix, ignores packages/) and packages/problem (tags problem-vX.Y.Z). Separate release PRs; breaking changes bump the minor while pre-1.0.
• release-please.yml runs on pushes to canary with GITHUB_TOKEN. Canary requires reviews but no status checks, so PRs opened by that token, which don't trigger CI, can still merge. Package releases are kept off the "Latest" badge so the Go module keeps it.
• publish.yml is unchanged in behavior: a release PR's package.json bump still triggers it.
• CONTRIBUTING.md describes the new flow.

Anchors: release-please starts from the GitHub release matching each manifest version, so I created v0.5.0 (existing tag) and problem-v0.1.0 (the commit that set 0.1.0). Without them it would rebuild the changelog from all history.

Testing

• make check
• After merge: the first run should open chore(problem): release ... only if packages/problem changed since 0.1.0, and a chore: release 0.5.1/0.6.0 PR once a fix/feat lands.

Checklist

• make check passes
• A new or changed shared message is in every language in packages/problem/src/messages/ (none changed)
• No code, rule or param was renamed (they are API contract)