Publish changelog entries as release notes

[trsdn]

Problem

CHANGELOG.md had an empty ## Unreleased section and was completely disconnected from the release pipeline:

• The publish job created the GitHub release with a fixed sentence ("Signed, notarized, stapled, and verified macOS release artifacts.") and never read the changelog.
• Nothing failed when a tagged version had no changelog section, or when entries were still parked under ## Unreleased — those entries silently never reached any release notes.
• bump-version.sh bumped the project and website version but left the changelog untouched, so drifting apart was the default outcome.

R06 of the Repository Quality Standard was recorded as pass on exactly this evidence, which shows how weak the criterion is when nothing consumes the changelog. A matching change to the standard is being prepared in trsdn/.github.

Change

The changelog is now the single source of the release body.

• scripts/changelog.sh (new): section <version|unreleased> prints one section, release-notes <version> [--output FILE] verifies release readiness and emits the notes. It fails when the version has no dated section, when that section is empty, or when entries are still parked under ## Unreleased.
• release.yml: the metadata job checks out the tooling, reads CHANGELOG.md from the tag itself, and gates the release before any test, build, or signing work happens. The published notes come from that section (gh release create/edit --notes-file).
• bump-version.sh: promotes the ## Unreleased entries into the new dated ## X.Y.Z - YYYY-MM-DD section and refuses to bump when there is nothing to release. It keeps updating the project and site version markers.
• check-documentation.sh: additionally verifies that the changelog keeps an ## Unreleased section and describes the current MARKETING_VERSION. The existing CI lint job already runs this script and bash -n scripts/*.sh.
• AGENTS.md / README.md: document the convention; CLAUDE.md stays a pointer.
• CHANGELOG.md: the user-facing work merged with Apply Repository Quality Standard v1.5.1 #33 is described as well, so the next release notes are complete.

Verification

• bash -n scripts/*.sh, scripts/check-documentation.sh, and scripts/verify-version.sh pass.
• Full bump flow exercised on the merged scripts: entries are promoted, project version, softwareVersion, both visible site markers, and the review date are updated, and the resulting tag passes the gate.
• Failure paths verified: unknown version, empty section, malformed date heading, parked unreleased entries, and bumping with an empty ## Unreleased.
• Gate replayed against every historical tag (v1.1.0–v1.2.0), so workflow_dispatch re-runs of older tags still work; v1.0.0 predates the changelog entirely.