feat(templates): unify What's new into the plugin-release pipeline

[mattmaynes]

Implements spec/plan 0006. Closes the dogfood gap from 0005: the automated 0.4.0 release tagged + published but the README "What's new" never refreshed.

Root cause (feedback 0006)

1. A GITHUB_TOKEN-created Release does not fire release: published workflows (GitHub suppresses token-made events to prevent recursion) - so a release-triggered whats-new never ran after the automated release.
2. The old whats-new.yml pushed straight to a ruleset-protected main, which rejects direct pushes (it had been failing every release).

Fix - the template now owns the whole pipeline

• whats-new.yml (owned): triggers on workflow_run of the Release workflow (fires regardless of how the release was made), reads the released version's notes via gh release view, and lands the README headline through an auto-created, self-squash-merged PR. Job-scoped contents+pull-requests: write, SHA-pinned checkout, release body via env: only.
• whats-new.sh (owned): one canonical, dependency-free script with neutral <!-- whats-new:start/end --> markers, so Trellis and Spectra run the same one.
• whats-new.test.sh (10 checks, sh+dash) wired into ci.yml.

Trellis re-adoption (dogfood)

Functional whats-new.yml/whats-new.sh swapped to the owned versions; README markers migrated; owned-list extended; 0005 architecture.md/features.md corrected; feedback + learnings recorded. Bumped to 0.4.1 so the pipeline refreshes the README end-to-end on merge.

Testing

whats-new.test.sh 10/10, bump-version.test.sh 22/22, check-compliance.test.sh 20/20 (sh+dash); bump-version.sh --check clean across 7 manifests; dogfood diff (installed == owned) clean; compliance clean; exactly one README marker pair.

🤖 Generated with Claude Code

[mattmaynes]

Review note

Persona sub-agents are still stalling on infra, so I reviewed inline across the four facets. No blockers.

• security - whats-new.yml workflow default is contents: read; the job adds only contents+pull-requests: write; checkout SHA-pinned; the (trusted, in-repo) release body reaches the script via env: only and is marker-stripped + length-capped. Fork-escalation is closed upstream: Release runs only on main pushes (gated event==push && head_branch==main); a fork-PR-triggered Release has its job skipped, so the run concludes skipped not success, and whats-new gates on success. Considered adding head_branch=='main' to whats-new as defense-in-depth and judged it redundant (Release is already main-only); noting it here as a deliberate choice, easy to add later.
• engineer - workflow shell ported from Spectra's working version: gh release view guard (clean exit when no release), multiline BODY via inline env assignment, PR open/merge retry loop. Sound.
• tester - whats-new.test.sh 10 checks (headline/first-line, name fallback, CRLF, marker sanitize, required TAG, --write rewrite, missing-markers error), green under sh+dash, wired into CI. The gh-fetch step is integration-only (not unit-testable); covered by the 0.4.1 end-to-end release this PR triggers.
• architect - marker unification (whats-new:start/end) and owned/seed boundary intact (README markers are consumer-owned; the script/workflow are owned). Dogfood diff clean.