Update docs: changesets is how a tool/workflow version bump ships

Documents the CL-8167 flow in CONTRIBUTING.md: run `bun run changeset`
and commit the generated file alongside a tool or workflow change,
instead of hand-bumping its version; the automated version PR does the
bump and changelog.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG

Author: TheGreatAxios

CONTRIBUTING.md

@@ -39,5 +39,14 @@ Thanks for your interest in Corbits Workbench.
    a package-owned ledger table, applied transactionally.
 8. Security issues go through [SECURITY.md](SECURITY.md), never a public
    issue.
+9. Changed a publishable `workflows/*` or `packages/*-tools` package?
+   Run `bun run changeset`, describe the change, and commit the
+   generated `.changeset/*.md` file alongside it — that's what the
+   tool-package-freshness check now expects instead of a hand-bumped
+   version. A "Version Packages" PR opened automatically off `main`
+   applies every pending changeset's version bump and changelog; merging
+   it is what actually ships the release to npm. See
+   [.changeset/config.json](.changeset/config.json) for which packages
+   are still `private` and excluded from this.
 
 This document will grow as the project does.