chore: fix release workflow

[felixarntz]

Pull Request Description

See https://github.com/vercel-labs/konsistent/actions/runs/28108086504/job/83227713715: The release.yml workflow was failing because it was missing the node_modules removal that's necessary with pnpm 11, per the workaround that's already in ci.yml.

The other problem is https://github.com/vercel-labs/konsistent/actions/runs/28108155991/job/83227961536?pr=32: For a new package (i.e. version is set to 0.0.0), we have to require a major changeset - only otherwise patch is required.

Relevant technical choices

• align dependency installation in release.yml with how it works in ci.yml
• harden permissions, only give the job the necessary permissions while keeping workflow permissions minimal
• require major changeset for packages with version 0.0.0, else require patch

Checklist

• All commits are signed (PRs with unsigned commits cannot be merged)
• Tests have been added / updated
• A changeset has been added (run pnpm changeset in the project root if package files were modified)
• I have reviewed this pull request (self-review)