ci: standardize release process

[eddietejeda]

Summary

• Add `scripts/release.sh` (prepare + publish)
• Auto-create GitHub Releases on tag push (`release.yml`)
• Require changelog entry when version bumps (`check-release.yml`)
• Add `RELEASING.md` and `CHANGELOG.md`

Test plan

• CI checks passing
• Changelog and release scripts added
• Verified `update_changelog.py` handles empty and non-empty `## [Unreleased]` correctly
• Fixed: `get_version` now runs after `git checkout $base` so bump is from the correct base version
• Run `./scripts/release.sh prepare patch` on next release (post-merge)

[claude]

Review

Blocking Issues

• scripts/release.sh update_changelog is broken in both branches:
  • Empty ## [Unreleased] branch (lines 135–145): The replacement string includes a literal ## [Unreleased] at both ends, producing two ## [Unreleased] headings in the output. This will fire on the very next release.sh prepare against the current CHANGELOG.md.
  • Populated ## [Unreleased] branch (lines 127–134): text.split("\n\n", 2) assumes the preamble is two \n\n-separated paragraphs, but the standard Keep a Changelog header in this PR has three. The new version section gets inserted between paragraphs 2 and 3 of the header, burying "The format is based on..." under the release notes. This is the documented release flow (RELEASING.md step 1: "Add user-facing notes under ## [Unreleased]"), so it will trigger on the first real use.

Action Required

• Replace the brittle split("\n\n", 2) logic with insertion before the first ## [X.Y.Z] heading (see inline suggestions on scripts/release.sh). Both branches can share the same anchor-and-insert strategy.
• Worth a quick end-to-end smoke test of ./scripts/release.sh prepare patch against the current CHANGELOG.md (empty Unreleased) and against a copy with notes under Unreleased, to confirm the output is well-formed before merging.

[claude]

Prior blocking issues are resolved — scripts/update_changelog.py now anchors on ## [Unreleased] so empty/populated sections both produce a single heading and a preserved preamble. Tests cover both regressions.

[claude]

Prior blocking issues are resolved — scripts/update_changelog.py now anchors on ## [Unreleased] so both empty and populated sections produce a single heading and a preserved preamble. Tests in tests/test_update_changelog.py cover both regressions.

[claude]

All three prior threads resolved: changelog updater preserves a single ## [Unreleased] heading in both empty and populated cases, the fragile split("\n\n", 2) is gone, and get_version/bump_version now run after the base-branch checkout. Tests in tests/test_update_changelog.py cover both unreleased scenarios.