chore: rebuild release flow around develop's history

[scode2277]

What does this PR change?

Reworks the release flow so the changelog comes from develop and ships with the monthly develop -> main PR.

Release steps: open the monthly PR → click the link the bot comments → review and merge the release PR into develop → merge the monthly PR right after it. Tagging and the GitHub Release happen automatically.

Changes

• Changelog built from develop: main only receives squash commits, so PR titles, authors and labels exist only on develop.
• release/next branch plus a one-click link on the monthly PR: the org doesn't allow Actions to open PRs, so the bot pushes the branch and a person opens the PR.
• Signed commits through the GitHub API
• Automatic sync while the release PR is open: new merges into develop are appended to the release PR. Entries are only added, so wording edited by hand is kept.
• route job: if prepare failed or never ran (GitHub skips PRs opened with a merge conflict), the next push to develop prepares the release instead of trying to sync.
• Read-only and write jobs split: git-cliff and PR titles only see a read-only token. The write jobs run only shell from this file, rebuild VERSION and the state file themselves, and accept a changelog only if it adds entries to the top section.
• .github/release-state.json: records the last version and the commit its changelog covered. A guard blocks preparing a new release while one is still unpublished.
• Publish keyed on VERSION on main: the old trigger waited for a release/* → main merge that this flow never does. Publish now tags the commit that set VERSION, refuses a pre-existing tag on any other commit, and is safe to re-run.
• PR titles rendered as plain text (cliff.toml plus a check in the write jobs): titles are contributor input and appear on the site's /changelog page, so <, >, [ and ] are escaped and @ mentions are disabled.
• Release PR lookup restricted to this repository at the exact release commit: a fork PR from a branch that happens to be named release/next can't be picked up or renamed.
• GITHUB_REPO set for git-cliff: the checkout is a single commit, from which git-cliff can't infer the repo, so it silently dropped PR links and authors.
• cliff.toml fixes: tags pulled in by syncs no longer split the release into extra sections; new Fixes group; release and skip-changelog labels are excluded; one blank line around headings.
• CHANGELOG.md converted to LF line endings (text unchanged) + fixed previous changelog that cut the end of the last line

Type of change

• New content
• Edit to existing content
• Outline / structure change
• Typo or formatting fix
• Tooling / config

If applicable

• Editing existing content: tagged the current contributors from the attribution list
• Framework has a steward: asked them to review
• Outline change: updated vocs.config.ts with the dev: true parameter
• Want community feedback: shared this PR in our Discord

Stuck on anything? Just write it here and we're happy to help.