ci: cut releases from main, and let the run cut the changelog

[andiwand]

🤖 Generated with Claude Code

Stacked on #677 — review that one first.

releases existed to hold the stamp commit, and cost tag reachability: since
the train, tags sit on commits main never sees, so git describe main is stuck
at v6.1.0 and release.py version cannot answer from main.

• Dispatch is the only trigger. A tag push cannot be one — the tag has to land
  on the stamp commit the run makes. The first job refuses a ref that is neither
  main nor release/**, since the dispatch UI offers every branch.
• The stamp goes to main, so tags become ancestors of main again.
• release.py cut heads the entries with the version and opens a fresh
  ## Unreleased, so there is no manual cut and nothing to sync between
  branches. It is idempotent, for re-runs.
• changelog reads ## <version> if it exists and ## Unreleased otherwise —
  the same lines before and after the cut, which is what lets the first job
  check the copy before anything is built.
• contents: write is scoped to the job that pushes; the other eight workflows
  drop the release-branch exclusion and take branches: ['**'] instead, so a
  published release's tag push does not run them twice.

Verified locally against git-cliff 2.13.1: check before the cut, dry-run cut,
cut, re-run cut, notes from the cut section, and the empty-Unreleased refusal.

Not done: the bypass

Pushing to main from the run needs the GitHub Actions app on the main
ruleset's bypass list, and the API refuses it:

Actor GitHub Actions integration must be part of the ruleset source or owner
organization

GitHub Actions is not an org installation, and the documented bypass actors are
roles, teams, installed GitHub Apps and Dependabot. So this needs either a
GitHub App for releases, or a PAT belonging to someone the existing role bypass
already covers — and with either, the stamp push starts the other workflows,
which GITHUB_TOKEN currently suppresses. Do not merge before that is
settled; the run would fail at the stamp push.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b67086cca8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".