Switch monorepo to npm core package

[flopez7]

c## Issue tracking
#3772

Context behind the change

This PR updates the monorepo so most packages consume @human-protocol/core from npm (instead of resolving it from the local workspace) to avoid rebuilding core on every CI/job. This removes a major build-time and keeps the repo history intact, while still allowing local core development when needed.

Main changes:

• Replaced workspace-based core resolution with npm resolution by updating consumers to use @human-protocol/core: "npm:^5.0.1".
• Extracted core build invocations from workflows/scripts that were implicitly rebuilding core, so they now rely on the published npm package artifacts by default.
• Split release/deploy responsibilities: created a dedicated workflow for contract deployments/releases (decoupled from the old cd-packages.yaml flow), so publishing and deployment steps can run earlier and independently.
• Created a separate Changesets configuration for the core package release flow to support running core publishing before changes land in develop.

Changesets notes
To enable independent contract deployments, core needed its own Changesets flow. That introduced friction with Changesets dependency validation:

• Keeping all dependents with a normal range like ^5.0.1 caused Changesets errors when the root Changesets config ignored @human-protocol/core but non-ignored packages (SDK) depend on it.
• Also tried excluding core from Yarn workspaces to prevent local resolution; however, to make Changesets fully “independent” in that mode, core effectively needs to live in a separate repo (Changesets’ model and validation assumes a single, coherent workspace graph).
• Final approach: keep SDK depending on @human-protocol/core via npm:^5.0.1 and the rest of the packages using ^5.0.1. This produces a warning during yarn changeset / yarn changeset version, and when running changeset version dependency ranges get updated for most packages but not for the SDK package (because of how Changesets applies dependency updates/validation in this split setup).

How has this been tested?

Deployed all services and verified dependency resolution behavior: consumers resolve @human-protocol/core from npm (not local) under the default Yarn config.
Generated some changesets for testing purpose.
Built all docker images.

Release plan

• Modify all packages deployment on render to use the new focused commands
  -Core publishing is handled via the core-specific Changesets flow/workflow and should run before merging to develop when a core release is required
• Contract deployments now run via the dedicated deploy workflow (decoupled from the old combined pipeline), so deployments can be triggered independently of general package publishing.
• If local contract changes are required for development, switch back to workspace resolution and run the core-local scripts as needed.
• Set up trusted publishing for this action

Potential risks; What to monitor; Rollback plan

Check services build time to make sure it is decreased considerably.
Check that all actions works fine.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
human-app	Ready	Preview, Comment	Feb 10, 2026 2:48pm
human-dashboard-frontend	Ready	Preview, Comment	Feb 10, 2026 2:48pm
staking-dashboard	Ready	Preview, Comment	Feb 10, 2026 2:48pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
faucet-frontend	Ignored	Preview	Feb 10, 2026 2:48pm
faucet-server	Ignored	Preview	Feb 10, 2026 2:48pm

[dnechay]

LGTM, one minor comment