chore(notes-ui): delete the retired notes reference surface

[unforcedagi]

Completes the notes retirement started in ParachuteComputer/parachute-hub#788, on the surface side.

The actual "it surfaces inside of surface" bug

web/admin/src/routes/Add.tsx used @openparachute/notes-ui[@version] as the npm placeholder in the add-a-surface form. So the retired module was the worked example for what to install. A placeholder is a recommendation whether or not you intend it as one — that's how notes kept resurfacing inside surface long after it stopped being maintained.

It now reads @scope/my-surface[@version]: a shape, not a package. Nothing first-party to mistake for an endorsement.

And the package itself

packages/notes-ui is deleted — 290 files. It was safe to remove outright, unlike hub's registry entry:

• nothing depends on it (@openparachute/notes-ui appears in no other package.json),
• it wasn't in the root build script,
• it's a published npm package, not something a running box resolves from this repo.

Also removed:

• the root test + typecheck script entries, and the dedicated test:notes-ui / build:notes-ui scripts,
• its release lane: the RELEASING.md package row, tag conventions, the "Releasing @openparachute/notes-ui" section, the tag-pattern troubleshooting mention, and the numbered Trusted-Publisher item (list renumbered),
• the publish-notes-ui-npm CI job and its notes-ui-v* tag triggers.

One subtlety worth a reviewer's eye: I dropped !startsWith(github.ref_name, 'notes-ui-') from the publish-surface-npm catch-all if. That exclusion existed so a notes-ui-* tag wouldn't also fire the bare-v... app publish. It's safe to remove only because the notes-ui-v* tag triggers went with it — such a tag can no longer start the workflow at all. If you'd rather keep the exclusion as belt-and-braces against a resurrected trigger, say so and I'll restore it.

Published notes-ui-v* versions stay on npm for anyone still installing one; nothing new ships from here. Recorded in RELEASING.md, along with the note that its npm Trusted Publisher rule can be dropped.

Verification

• bun run typecheck:all clean (root + admin).
• Root test script: 0 fail across every remaining suite.
• web/admin vitest: 99 pass — including the Add-form tests, retargeted off the notes-ui placeholder.
• surface-render: 69 pass.
• release.yml still parses as valid YAML; six publish jobs remain, correctly bounded.

Version 0.2.2 → 0.2.3 (surface ships stable patch bumps, not rc, per workspace governance).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RPoTHLWtNvRVWYcs1K5i8b