fix(release): don't treat changelog edits as a reason to ship

[Ripwords]

CHANGELOG.md lives inside an artifact's own paths, so a changelog-only commit that isn't a release commit reads as a source change.

Restoring the eroded changelog history (#8) did exactly that. The very next dry-run offered to:

    sdk          0.4.2 → 0.4.3 → sdk-v0.4.3       → npm (@reprojs/core)
    dashboard    0.6.5 → 0.6.6 → v0.6.6           → Docker Hub image
    extension    0.1.4 → 0.1.5 → extension-v0.1.5 → Chrome Web Store (public review)

— publish a new SDK to npm (immutable 72h), rebuild the image, and push the extension into public Web Store review, with no code change behind any of it. --dry-run caught it before anything shipped.

Fix

Exclude *CHANGELOG.md from affected-detection. It's a release artifact, not source; editing one is never a reason to ship a package.

This can't hide real work — no source lives in a CHANGELOG — and it's independent of the existing release-commit exclusion, which covers the version bump in package.json. The two together mean nothing a release itself writes can make the next release look necessary.

Verification

Both directions, in a throwaway clone on main:

Scenario	Result
After the changelog-only restore	expo only — no spurious sdk/dashboard/extension ✅
A real packages/ui change	sdk + dashboard + extension all appear ✅

The second matters most: it proves the exclusion narrowed the false positive without blinding detection to genuine work.

🤖 Generated with Claude Code