Fail release.sh fast on a missing CHANGELOG entry

[wr]

What

release.sh sources the GitHub release body and the Sparkle in-app notes from the ## v<version> section of CHANGELOG.md. That check only ran right before gh release create — i.e. after the Release build, notarization, and stapling. When the entry is missing, the script aborts having already spent ~4 minutes on notarization.

This moves the check to pre-flight, before the version bump and build, so a missing changelog fails in seconds.

Also brings the /release command doc in line with how the script actually works:

• Notes come from CHANGELOG.md, not a temp file passed into the script — rewrote Step 2 to "write the changelog entry" and dropped the stale placeholder-notes replace step.
• Fixed the post-release DMG path (dist/Mojito.dmg, no version suffix).
• Fixed a fragile edSignature grep that could report an adjacent release's signature.
• Split the xcrun --find notarytool stapler line (it errors — one tool name per call).

Test plan

• scripts/release.sh 9.9.9 now aborts in <1s with no '## v9.9.9' section found in CHANGELOG.md, leaving project.yml unbumped and the tree clean. Verified.
• Full path exercised end to end shipping v1.8.1 (build 32) — GitHub release + appcast published, signature matches.

[wr-claude-reviewer]

Pre-flight guard is well-implemented. The awk pattern correctly captures section content, and bash $() stripping means a header-only section (blank lines only) also fails the emptiness check as intended — no content, no release. Placement after the SU_PUBKEY check and before BUILD_DIR / version bump means a missing entry aborts with a clean tree as stated.

Doc updates in release.md are accurate: Step 2 correctly redirects to writing the CHANGELOG entry instead of collecting notes ad hoc, Step 4 no longer asks to replace placeholder notes, the DMG path is fixed, and splitting xcrun --find notarytool stapler into two calls is the right fix.

One observation on the new appcast grep:

curl -sf "https://mojito.wells.ee/appcast.xml" \
  | grep -o "…/Mojito.dmg[^/]*sparkle:edSignature=\"[^\"]*\""

[^/]* between Mojito.dmg and sparkle:edSignature= would silently return nothing if type="application/octet-stream" appears before sparkle:edSignature in the <enclosure> attributes (the / in octet-stream terminates the match). Since you verified this against v1.8.1, the attribute order in your appcast must already put edSignature before type — but it's worth a short comment noting that ordering dependency so a future update_appcast.py refactor doesn't silently break the verify step. Not blocking given the production test, just a heads-up.