fix(scripts): protect released changelog sections (fixes #1884)

[MoerAI]

Summary

Fixes #1884. The changelog gate now rejects changes to previously released
sections instead of treating any changed CHANGELOG.md filename as sufficient.

Root cause and change

The CLI collected changed paths but never compared changelog contents. It now
compares committed sections at the PR merge base and HEAD, including deleted and
renamed files. Violations name the file, line and section. no-changelog cannot
waive released-history immutability.

The existing Unreleased block can still be stamped into a new release. The
regression invokes the actual release helpers and checks both stamping and
next-cycle insertion.

Reproduction and verification

The regression drives the real gate CLI in an isolated temporary Git repository.
Before the fix, all five invalid cases returned:

changelog-gate: PASS - changes.md coverage complete (0 production path(s) covered); no runtime source changes detected
0 !== 1

Those cases cover a released addition, modification, deletion, whole-file
deletion and a no-changelog bypass attempt. A further failing boundary case
covered inserting a second Unreleased heading below a release.

After the fix, all six invalid cases exit 1 with a path/line/section diagnostic.
Unreleased edits, actual release stamping and next-cycle insertion still exit 0.
Fixture repositories are removed by the test cleanup.

• node --test scripts/check-pr-changelog.test.mjs: 20 passed.
• Gate, tracker and audit tests: 45 passed.
• npm run check: exit 0; six pre-existing informational diagnostics in untouched tests.
• npm run build: exit 0.
• npm test: 300 passed / 6 failed in the script stage. All six failures are
  native-grep setup failures (cargo metadata failed to run); cargo is absent
  locally, and the unchanged current-main snapshot reproduces them. Workspace
  tests were not reached, so a complete local test pass is not claimed.

No agent-runtime behavior or published changelog content is changed.

---

Summary by cubic

Fixes #1884 so the changelog gate rejects changes to released sections instead of accepting any changed CHANGELOG.md filename.

• Compares committed changelog sections against the PR merge base, including deleted and renamed files, and reports the path, line, and section on violation.
• The no-changelog label can no longer waive released-history immutability.
• Release stamping moves the Unreleased block into a new released section and inserts an empty next cycle; this is confirmed by regression tests.

^{Written for commit 95b2e71. Summary will update on new commits.}