D-30: publish pipeline for @operant/qa-* packages

---
feature_id: FEAT-studio-qa-projects
---

> D-30 ticket 3: @operant/qa-* publish pipeline via GitHub Packages. Target FEAT-studio-qa-publish-pipeline (child). BLOCKED-BY: OPER-189 + OPER-190.

## Context

(PDT decision-memo lineage; see source line below.)

**Source: PDT D-30 (Studio QA external product surface), ticket 3 of 3.**

## What
Add release pipeline at `.github/workflows/publish-qa-packages.yml`:
- Triggered on tag push (`v*.*.*` pattern on qa-scoped packages)
- Changesets-driven changelog via `.changeset/` directory
- `changesets/action` for semver enforcement
- Private-scope registry: GitHub Packages (D-30 open question 2 default)

## Initial publish
At ticket close, publish v1.0.0 of:
- `@operant/qa-inbox-ui@1.0.0`
- `@operant/qa-embed-contract@1.0.0` (types + docs)
- `@operant/qa-bff@1.0.0`

## Unblocks
- POR-771 #1702 (Portico embed mount) — replaces pending workspace ref with published package
- Any future Studio-built product's embed integration

## Acceptance Criteria
- [ ] Workflow file exists and passes CI dry-run
- [ ] `.changeset/` directory scaffolded with initial changesets for v1.0.0
- [ ] GitHub Packages registry configured with private scope
- [ ] Three packages published at v1.0.0 to the registry
- [ ] Documentation at `docs/platform/qa-packages-publishing.md`

## Feature
FEAT-studio-qa-publish-pipeline (add via feature-map + depmap two-PR sequence FIRST)

## Blocked-by
Tickets 1 (embed contract frozen) and 2 (BFF package exists) — this ticket publishes them.

## Size / Band
SMALL-MEDIUM / assurance.