Contributing to Sessionboxer: layout, design docs, releasing

Architecture, decisions and the milestone log are in docs/DESIGN.md, the vocabulary in CONTEXT.md, and the reasoning behind each decision in docs/adr. Layout is npm workspaces: apps/control-plane (server), apps/web (UI), apps/cli, apps/desktop (Electron tray shell), packages/sandbox-daemon, packages/computer-use-mcp and packages/sessionboxer-mcp (run inside the box), packages/protocol (shared types), images/sandbox (the Sandbox image), images/control-plane (the Control Plane image for Compose). npm run dev -w @sessionboxer/web starts the UI with hot reload against a running server.

Releasing: bump the version in the root and every workspace package.json (including the @sessionboxer/* dependency versions) and package-lock.json (npm install), add a ## <x.y.z> section to CHANGELOG.md, commit, then git tag v<x.y.z> && git push origin main v<x.y.z>. The release workflow checks that the tag matches the version, typechecks and builds, assembles the npm package (npm run pack → build/sessionboxer-<x.y.z>.tgz), builds both images for amd64 and arm64 on native runners and pushes them to GHCR as <x.y.z> and latest, publishes to npm through trusted publishing (the workflow is registered as the package's trusted publisher on npmjs.com; an NPM_TOKEN repository secret works too), and creates the GitHub Release from the changelog section.