[SalesForce] How to change a field type in production instance using a change set

These are always tough.. If it's that often referenced I often go for a new field instead of field type change. That way you will suffer less from references and dependencies between classes, as you don't have to do a 'big bang' scenario but have the option to move over gradually if things don't go that smoothly. It might seem relatively easy doing this on a sandbox, but wait until e.g. your test coverage drops because of the commented out fields..

Main drawback is that all list views, reports, etc need to be updated as well since it will be a different field. And you will need a (simple) data migration.

Also, did you check for references in the rest of the org, e.g. formula fields, validation rules, workflow rules & field updates?

To get the complete picture, I often do a download of the complete metadata to Eclipse (refresh the metadata and check all the checkboxes to get all the metadata) and use CTRL+H to search across the entire project. That will also give you references in workflow, formulas, list views, reports etc. It also gives you the option to search and replace and save directly to the org from which you fetched the data (e.g. production).

really interesting use case. I've been out of permission sets for a while so I'm not sure I have a fantastic answer for 'why' this is occurring beyond the fact that managed components have a complex ownership and containment model (e.g. do you own it as a subscriber or does the publisher own rights to mutate?).

The ISV force guide provides some guidance around this - which recommends creating cloned permission sets with the managed permissions. Check out https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/packaging_perm_sets_profile_setttings.htm for more information.

The typical workaround I usually recommend when all else fails is to manage permission via the API directly post change set deployment.

It's relatively easy to run SOQL on your sandbox permission sets and then upsert those permissions via the API pointing to your product instance post deployment.

Some good posts I wrote up previously include:

http://www.salesforcehacker.com/2013/02/soql-pinball-wizard-cleans-up.html

and

http://www.salesforcehacker.com/2013/01/using-soql-to-determine-your-forcecom.html

Good luck!! Let me know how it goes!!