feat(release): publish the version's changelog section as the release notes

[Farahat612]

Release tags are lightweight, so the workflow's gh release create --notes-from-tag had nothing to read beyond the "Bump to vX.Y.Z" commit
subject: every GitHub Release shipped with an effectively empty
description, and release watchers saw no notes (#192).

scripts/changelog-notes.ts (zero-dep, node:-only) extracts the version's
level-2 section from CHANGELOG.md: exact version match (0.6.1 never
matches 0.6.10), tolerant of v/bracketed/dated headings, bounded by
the next version heading. Missing section falls back to a changelog
link; a prerelease with no own section borrows the base version's notes
with a prerelease preamble; bodies are cut at 120k chars on a line
boundary. Every path returns a body: notes can never fail a release.

The publish job writes the notes to a file and passes --notes-file
(never shell-interpolated: changelog prose is full of backticks), and
on re-runs backfills only releases whose body is empty, so hand-edited
release pages are never overwritten. The docker-only path creates no
release and is untouched. release.ts now surfaces the resolved notes
state in its pre-flight summary so a missing section is visible before
the tag is pushed.

Tests (bun test, wired into the root test script as test:scripts) cover
section bounding, version prefix collisions, fallback and prerelease
borrowing, truncation, and extraction against the real CHANGELOG.md.

Closes #192.

The actual mechanism: release tags are lightweight, so gh release create
--notes-from-tag had nothing to read and release bodies shipped empty. Most
recent example: v0.6.5 was released with an empty release description; with
this change it would have carried its changelog section, or a changelog link
for a version without one.

The extractor is zero-dependency (node: imports only, runs on bare bun with
no install) and can never fail a release: a missing section falls back to a
changelog-link body, a prerelease with no section of its own borrows the base
version's notes with a preamble, and bodies are cut at 120k chars on a line
boundary. Notes pass through a file so changelog backticks never hit the
shell. Re-runs backfill only empty release bodies, so a hand-edited release
page is never overwritten. The docker-only path creates no release and is
untouched.

Rebased onto current main, so it sits alongside the new release gate job
rather than replacing anything in it.

How verified: 15 bun:test cases (wired into the root test script) including
extraction against the real CHANGELOG.md for every version heading; dry-run
extractions for v0.6.1, v0.4.9, v0.2.0, a prerelease, and missing-section
cases; workflow YAML parse-checked after the rebase, confirming the publish
job keeps both the new gate dependency and the notes steps.