Keep LibreSign release history canonical in the app repository

[vitormattos]

Parent: #70
Depends on: #73, #81, #84, #88
Related: LibreSign/documentation#97

Goal

Keep LibreSign release history canonical in the application repository and document the release process without duplicating changelog content into LibreSign/documentation.

Source of truth

The only changelog / release-history source is:

LibreSign/libresign/docs/changelogs/changelog-<major>.md

Package-root CHANGELOG.md and GitHub Release notes are derived presentations of the same released section.

LibreSign/documentation documents the process, recovery procedure and where the canonical changelog lives. It must not maintain generated or manually synchronized copies of the changelog.

Repository boundary

• LibreSign/libresign owns per-major changelog files and released history.
• LibreCodeCoop/release-tool owns release contracts and policy.
• LibreCodeCoop/github-workflows owns orchestration only.
• LibreSign/documentation owns human documentation of the process, not release-history data.

The app package must not depend on the documentation repository.

Acceptance criteria

• no changelog synchronization into LibreSign/documentation;
• no duplicated generated release-history pages in LibreSign/documentation;
• documentation clearly points maintainers to the canonical per-major changelog in LibreSign/libresign;
• package-root CHANGELOG.md and GitHub Release notes remain derived from the released changelog section;
• security-mode releases do not expose advisory-private content through documentation;
• Document the complete LibreSign release lifecycle and manual path LibreSign/documentation#97 reflects this single-source model.

Definition of done

• the previously introduced documentation history synchronization is removed;
• LibreSign/documentation contains process documentation only, with no copied release-history dataset;
• the canonical changelog remains in LibreSign/libresign only;
• documentation explains the mapping from canonical changelog to package and GitHub Release presentations;
• Document the complete LibreSign release lifecycle and manual path LibreSign/documentation#97 reflects the implemented process and source-of-truth boundary.

[vitormattos]

Implementation status: post-publication history synchronization is implemented in github-workflows main. It only runs after successful PublicationVerification v1, generates deterministic Sphinx/RST pages from the exact PreparedRelease changelog section, and creates/updates a reviewable PR in LibreSign/documentation using a documentation-scoped GitHub App token.

LibreSign/documentation#98 bootstraps the already published LibreSign 13/14/15 history and documents the production lifecycle. LibreSign/libresign#8513 wires the post-publication sync into the consumer workflow. I am leaving this issue open until the consumer integration is merged and exercised.

[vitormattos]

Architecture correction: the generated documentation release-history synchronization has been removed. LibreSign/libresign remains the only changelog/release-history source. github-workflows#110 removed the sync action/script/tests, #111 removed the now-unused publication outputs, LibreSign/libresign#8513 no longer calls a documentation sync stage, and LibreSign/documentation#98 removes the duplicated release-history pages. #70 and documentation#97 were updated to reflect this single-source model.

[vitormattos]

Closing evidence: documentation#97 is merged/closed; github-workflows main no longer contains the release-history sync action/script/tests; LibreSign/documentation main contains no developer_manual/release-history/* dataset; and the canonical changelog remains LibreSign/libresign/docs/changelogs/changelog-<major>.md. Package/GitHub Release presentations continue to derive from that source.