Summary

Wires CHANGELOG.md into the release workflow as the single source of truth for release notes. Replaces `--generate-notes` (raw PR list — disqualified by OpenSSF BestPractices `release_notes`) with curated content extracted from the CHANGELOG.

Contributor workflow

1. As part of any PR worth mentioning in release notes, add a bullet under `## [Unreleased]` in `CHANGELOG.md`.
2. When releasing:
   • Fire `release.yml` via `workflow_dispatch` with a bump (patch/minor/major).
   • The workflow auto-promotes `[Unreleased]` → `[X.Y.Z] — YYYY-MM-DD`, inserts a fresh `[Unreleased]` above it, commits the rename to main as `github-actions[bot]`.
   • The extracted section becomes the GitHub release body.
3. If `[Unreleased]` is empty when you fire the workflow, the release fails with a clear instruction. No silent `--generate-notes` fallback — you curate or you don't release.

Implementation

New step: `Resolve release notes from CHANGELOG.md` (runs after `download-artifact`):

• awk-extracts the block under `## []` up to the next `## [` heading.
• Tries `## [vX.Y.Z]` then `## [X.Y.Z]` (the file convention is no-`v`; Keep-a-Changelog style).
• If the tag's section is absent, promotes `[Unreleased]` via a tiny inline Python edit and pushes the rename commit to main.
• Fails fast if neither the target section nor a non-empty `[Unreleased]` exists.
• Emits the extracted section as a multi-line step output.

Modified step: `Create GitHub release` — now writes `release-notes.md` from the extracted body + the existing cosign Verify footer, and passes it via `--notes-file`. Removes the draft-then-edit dance.

CHANGELOG.md — adds a contributor note at the top explaining the promotion flow so it's discoverable without reading release.yml.

Consequences

• ✅ `release_notes` BestPractices criterion stays Met across every future release — by construction.
• ✅ CHANGELOG.md on main always reflects what was released.
• ⚠️ The binary's embedded `Commit` SHA is the pre-rename commit (`github.sha` captured during the build job), while the tag points to the post-rename commit. The binary bytes are unaffected. Acceptable mismatch — CHANGELOG.md is doc, not code.

Test plan

• Merge this PR
• Verify `## [Unreleased]` has non-empty bullets on main (already does — from PR chore: governance/community files + finish BestPractices passing tier #46/chore: add CHANGELOG.md + fill missing BestPractices criteria #48/ci: drop macOS from test matrix (fix TestScale_1000Notes flake) #49/ci(release): drop goreleaser (Pro-only prebuilt) — inline cosign + gh release #50)
• Delete stale `v0.0.3` tag: `git push origin --delete v0.0.3`
• Fire: `gh workflow run release.yml --ref main -f bump=patch`
• Confirm CHANGELOG.md on main got a fresh rename commit
• Confirm `v0.0.3` release body on GitHub contains the curated section + cosign footer (NOT the auto PR list)
• Confirm `cosign verify-blob` succeeds

🤖 Generated with Claude Code