Add a shared changelog protocol (roll-changelog + verify-changelog)

[mabry1985]

Summary

Add a fleet-shared changelog protocol to release-tools — a roll-changelog bin (promote [Unreleased] → a dated version section) plus a verify-changelog check (PR gate) — mirroring the existing init/verify-workspace-config and apply-branch-protection bins. Today each repo that wants a committed changelog has to carry its own script; this centralizes it like the rest of our release plumbing.

Motivation

We just prototyped this in protoAgent (manual-cadence releases + a committed CHANGELOG.md):

• scripts/changelog.py roll <version> — moves everything under ## [Unreleased] into a dated ## [X.Y.Z] - YYYY-MM-DD section, leaving a fresh empty Unreleased block.
• prepare-release.yml runs the roll and commits CHANGELOG.md inside the chore: release vX.Y.Z PR, so it passes through the branch ruleset (PR + required checks) like any change — release.yml never pushes to main directly.
• Keep a Changelog format; contributors add entries under [Unreleased] in their feature PRs.

It works, but it's a per-repo Python script. Every repo on the standard will want the same thing, and rewrite-release-notes already owns the outbound notes (Discord embed from the commit range) — an in-repo changelog is the complementary half, and both belong in the shared toolkit.

Proposed surface

Mirror verify-workspace-config's zero-dependency, node-builtins-only style:

• bin/roll-changelog.mjs --version X.Y.Z [--date YYYY-MM-DD] [--root .]
  Promote [Unreleased] → ## [X.Y.Z] - <date>; recreate an empty [Unreleased]; normalize blank lines. No-op-safe; non-zero + clear error if there's no [Unreleased] heading.
• bin/verify-changelog.mjs --root . (the PR gate)
  Assert CHANGELOG.md exists, has an [Unreleased] heading, and (optionally, configurable) that the PR diff adds at least one entry under it. Plugs into checks.yml next to verify-workspace-config.
• Optional: bin/init-changelog.mjs to seed the Keep a Changelog skeleton, paralleling init-workspace-config.

Integration shape

• prepare-release.yml (consumers): replace the local scripts/changelog.py roll step with npx -p @protolabsai/release-tools roll-changelog --version "$V" once published (depends on Publish v1.1.0 to npm — verify/init-workspace-config bins missing from the 1.0.0 package #27).
• release-tools@v1 action could optionally call roll-changelog itself, but doing it in the prepare-release PR (so it's gated by the ruleset) is the safer default — worth documenting either way.

Notes / cross-refs

• Pairs naturally with Run apply-branch-protection across the fleet to drop CodeRabbit from required checks (incl. rulesets) #25 (apply-branch-protection rulesets) — a repo with the ruleset can't have CI push the changelog to main, so the "roll inside the release PR" pattern above should be the documented default.
• Blocked-ish on Publish v1.1.0 to npm — verify/init-workspace-config bins missing from the 1.0.0 package #27 for the npx -p @protolabsai/release-tools invocation path; until then consumers can run the bin via the same git clone --depth 1 shim checks.yml already uses for verify-workspace-config.

Happy to port the protoAgent prototype (scripts/changelog.py + the prepare-release roll step + the Keep a Changelog seed) as the starting implementation if useful.