Fix/release manifest guard

[eschaar]

Title: chore(ci): stabilize release pipeline and dependency automation

Summary

• Fixes release orchestration so manifest/tag drift checks no longer block valid pending releases.
• Migrates GitHub App token generation to create-github-app-token v3 using client-id secret input.
• Improves Dependabot automation by updating eligible PR branches before enabling auto-merge.
• Upgrades automerge workflow action dependencies (fetch-metadata and github-script).
• Updates Dependabot policy:
  • github-actions checks daily
  • open PR limits tuned to 5 for both github-actions and pip
• Restores and normalizes 2.0.x changelog entries in release-please style.

Why

• Release 2.0.3 was stuck: release workflow failed before release-please execution, so no GitHub release was published and publish workflow never triggered.
• Dependabot PRs could remain behind main, reducing auto-merge reliability.
• Dependency automation needed tighter, clearer policy while keeping CI usage under control.
• Changelog needed consistency and completeness for the 2.0.x sequence.

Version impact

• None
• Patch
• Minor
• Major