[evandhoffman]

Summary

docs/changelog.md is now the one source of release notes. This closes item 7.7 of #126, which was the last open item.

• The changelog: docs/changelog.md starts with ## Unreleased, then one section per version: ## vX.Y.Z (build N), YYYY-MM-DD. It is seeded with v2.4.13 to v2.5.4, written for testers. A release PR adds "- " lines under ## Unreleased.
• scripts/changelog.py: three subcommands, with 61 tests that were written first.
  • check [--require-unreleased] checks the layout, the version order and the 4000-character TestFlight limit. It also refuses Markdown formatting in the notes.
  • release renames ## Unreleased to the new version.
  • notes writes one section.
• Release job (bump-build-number.yml):
  • It checks ## Unreleased before the bump, releases the section, and commits docs/changelog.md with the version.
  • It writes the notes before any push, so a refusal pushes nothing.
  • The GitHub release takes the section, plus a "Full Changelog" compare link.
• release-testflight.yml: "What to Test" takes the same section. ci/testflight-notes.txt is deleted. An old tag with no section gets a warning, not a failure.
• publish-release.yml: the fallback for a tag pushed by hand takes the notes from the changelog at the tag. It refuses a version with no section.
• New Changelog check: it runs on Linux, on every PR and on every label change. A PR without skip-release fails when ## Unreleased is empty. A label change does not rerun the iOS tests.
• AGENTS.md: the changelog rules, and the required checks. The pre-commit setup is now uv tool install pre-commit && pre-commit install, with the core.hooksPath fix.

After this merges, Changelog becomes a required check on main.

Verification

• actionlint: no findings.
• uv run ruff format --check . && uv run ruff check . && uv run mypy && uv run pytest -rs: 134 passed, 0 skipped.
• pre-commit run --all-files: all 12 hooks pass.
• A simulated release on copies of the project and the changelog:
  • bump_version.py, then changelog.py release, then notes gave ## v2.5.5 (build 57) and the exact notes.
  • check --require-unreleased fails on the empty ## Unreleased.

Release

skip-release. CI, tooling and docs only.