ci(release): notes via workflow input, attached as CHANGELOG.md asset (no repo maintenance)

[aksOps]

Revised approach

After the initial "extract from CHANGELOG.md" design, the user requested zero in-repo overhead:

create a changlelog.md file in release itself with the content same as release note. no overhead

So this PR flips the flow again — release notes come from a `notes` workflow input, not from a CHANGELOG.md section.

New release procedure

```sh
gh workflow run release.yml --ref main \
-f bump=patch \
-f notes=$'### Changed\n\n- Describe changes here...\n\n### Upgrade impact\n\nDrop-in replacement.'
```

That's the entire release flow. One CLI command.

What happens

1. Workflow takes the `notes` input as the source of truth.
2. Writes the notes to `dist/CHANGELOG.md`.
3. Uses the notes as the GitHub release body (with the cosign verify footer appended).
4. Uploads `dist/CHANGELOG.md` as a release asset alongside binaries / sigs / SHA256SUMS / provenance.

What's removed

• The auto-rename + `git push origin HEAD:main` step (was rejected by branch protection).
• The `extract from CHANGELOG.md` logic (required maintaining a live `[Unreleased]` section or pre-release PR).
• The per-version sections in in-repo `CHANGELOG.md` — that file is now a thin static pointer to the Releases page.

What stays

• ✅ Signed binaries (cosign keyless, Rekor-anchored)
• ✅ Signed SHA256SUMS
• ✅ SLSA build provenance
• ✅ BestPractices `release_notes` Met — release body is curated human-readable notes, CHANGELOG.md asset attached to every release

Files

• `.github/workflows/release.yml` — adds `notes` input, replaces extract step with prepare-notes step, adds `dist/CHANGELOG.md` to release assets.
• `CHANGELOG.md` — reduced to a static pointer file explaining the release procedure. No per-version entries to maintain.

Net: -117 / +41 lines.

Test plan (for v0.0.4)

• Merge this PR

• Run:

  gh workflow run release.yml --ref main \\
    -f bump=patch \\
    -f notes=\$'### Changed\\n\\n- Drop auto-push from release workflow — notes now come from workflow input and are attached as CHANGELOG.md asset.\\n- Thin in-repo CHANGELOG.md.\\n\\n### Upgrade impact\\n\\nDrop-in replacement.'
  

• Confirm release v0.0.4 on GitHub:

  • Body has the curated notes + cosign verify footer
  • Assets include `CHANGELOG.md` with the same notes
  • Assets include signed binaries + SHA256SUMS
  • `.intoto.jsonl` provenance bundle uploaded

🤖 Generated with Claude Code