feat: modernize CI toolchain

[rathpc]

Summary

Modernize cli-library — refresh semantic-release deps, standardize .releaserc rules, update CI workflow to Node 24 + actions/checkout@v6 + floating-tag step, and add CLAUDE.md.

This is a deliberately lighter-touch upgrade than the Wave 2 sibling repos — cli-library has no JavaScript source (its subfolders are composite actions, YAML-only), so esbuild/Jest/DI patterns don't apply. The work here is dep hygiene + release-config standardization + workflow refresh.

What changed

• semantic-release: 19 → 25 (latest stable). @semantic-release/changelog refreshed to 6.0.3.
• engines.node: added >=24 for consistency with the repo family (release workflow runs Node 24).
• .releaserc: standardized to the patch-on-every-commit-type rule set used across the repo family. assets glob updated from action.yml (no path prefix — matched nothing in this subfolder-organized repo) to */action.yml so subfolder action files are committed by the release commit when they change. This was a latent bug — the previous config silently did nothing with the action.yml asset entry.
• CI workflow: Node 20 → 24, actions/checkout@v4 → @v6. cli-config ref pinned to @v1.3.0 exact (cli-config has no floating major tag yet — will bump to @v2 in a follow-up after cli-config's Wave 2 PR ships). New "Update floating major/minor tags" step. Self-test step gated on vars.YONTRACK_URL != '' so fork PRs without that var don't fail.
• Docs: new CLAUDE.md.

Follow-ups (intentionally NOT in this PR)

• Bump composite action's cli-install reference from @v1.1.0 (current exact pin) to @v2 (floating major) once cli-install ships its Node 24 upgrade. That upgrade is being prepared but blocked on @nemerosa/ontrack-github-actions-module-install package read-access for outside contributors. Once the cli-install PR merges, a one-line follow-up here can bump the ref.
• Bump cli-config@v1.3.0 in this workflow to @v2 floating once cli-config's Wave 2 PR ships.

Why this is breaking

The release workflow now requires Node 24 to run npx semantic-release. Self-hosted runners on older Node will fail. GitHub-hosted runners support Node 24 natively.

Test plan

• CI passes on this PR (just npm ci + the gated Yontrack configuration step on internal PRs)
• After merge, semantic-release publishes the next version
• Floating tags vX and vX.Y exist after release

Squash-merge commit message

When merging, please use this exact commit body:

feat: modernize CI toolchain

- Bump semantic-release 19 -> 25; refresh @semantic-release/* plugins
- Standardize .releaserc rules (patch on every commit type); fix subfolder action.yml asset glob
- Update CI workflow: Node 20 -> 24, actions/checkout@v4 -> @v6, gate self-test on vars.YONTRACK_URL
- Add floating major/minor tag step in CI
- Add CLAUDE.md

BREAKING CHANGE: Release workflow now requires Node 24 to run
semantic-release. Self-hosted runners on older Node will fail;
GitHub-hosted runners support Node 24 natively.

[rathpc]

@dcoraboeuf here is another in the batch for your review

[dcoraboeuf]

Available in 1.0.3.

Thanks for your contribution again @rathpc