ci(release): pin tags and fill changelog

[davidbudnick]

Summary

Stops release-plz from tagging a late master tip after a failed publish, and fills the root changelog with every release-worthy commit since the last tag (including gui/agent-only work that package-scoped release-plz drops).

Changes

• release-plz.toml: release_always = false so publish/tag only runs when the release PR merges
• release-plz.yml: gate the release job on chore: release* / workflow_dispatch, and check out the version-bump commit before tagging
• scripts/release/augment_changelog.py: after release-pr, merge all feat|fix|perf subjects since the last v* tag into CHANGELOG.md (covers release = false app crates that cannot use changelog_include / git_only)
• unit tests for the augment helper

Testing

python3 scripts/release/test_augment_changelog.py
release-plz update --allow-dirty   # only #522 in CHANGELOG
python3 scripts/release/augment_changelog.py
# 0.6.24 section then includes both #508 and #522

Not runtime-tested as a full GitHub Actions publish/tag (crates.io token path out of scope).

Notes

Leave #509 open; after this lands on master the bot will refresh it and the augment step will fill the missing entries.

[greptile-apps]

Greptile Summary

The PR moves root changelog generation to git-cliff and restricts release publishing to release commits or manual dispatches.

• Adds whole-repository changelog generation to the release-PR workflow.
• Configures git-cliff and a script to regenerate the current version section from commits since the last version tag.
• Disables release-plz changelog ownership and unconditional releases.
• Locates and checks out a version-bump commit before publishing and tagging.

Confidence Score: 4/5

The PR does not yet appear safe to merge because manual recovery can still publish and tag a different source tree than the selected failed release commit.

The release job discards the event checkout and searches history by version, while repository history contains duplicate release commits for the same version; recovery can therefore select a newer matching commit and publish different code.

Files Needing Attention: .github/workflows/release-plz.yml

Important Files Changed

Filename	Overview
.github/workflows/release-plz.yml	Adds changelog generation and release-source checkout, but the previously reported version-only commit lookup remains ambiguous when history contains multiple release commits for one version.
cliff.toml	Defines whole-repository conventional-commit filtering and Keep-a-Changelog rendering for git-cliff.
release-plz.toml	Transfers changelog ownership away from release-plz and prevents unconditional publishing from later master commits.
scripts/release/write-changelog.sh	Replaces the fingerprint-based augmentation helper with deterministic regeneration of the current version section, resolving the prior non-PR fingerprint duplication mechanism.

Sequence Diagram

sequenceDiagram
  participant RP as release-plz PR job
  participant Cliff as git-cliff
  participant Branch as Release PR branch
  participant Master as master
  participant Release as release job
  RP->>Cliff: "Generate notes since latest v* tag"
  Cliff-->>RP: Updated CHANGELOG.md
  RP->>Branch: Commit and push changelog
  Branch->>Master: Merge release PR
  Master->>Release: Trigger on release commit
  Release->>Release: Locate version-bump commit
  Release->>Release: Publish crates and create tag

Loading

_{Reviews (3): Last reviewed commit: "refactor(release): use git-cliff for who..." | Re-trigger Greptile}