chore(release): add CHANGELOG and scripted release pipeline

Introduce CHANGELOG.md (Keep a Changelog) as the single source of release
notes, and scripts/release.sh (npm run release X.Y.Z) which promotes the
Unreleased section, commits the bare version as a real release commit, tags
it, and reopens the next -develop cycle. The Release workflow now verifies the
tagged commit's version equals the tag and publishes the CHANGELOG section as
the release notes instead of auto-generated commit lists.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

package.json

@@ -18,6 +18,7 @@
     "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit && npm run typecheck:client",
     "typecheck:client": "tsc -p src/scripts/client/tsconfig.json --noEmit",
+    "release": "bash scripts/release.sh",
     "prepare": "husky && npm run build:client"
   },
   "lint-staged": {