Release notes credit no one: --offline disables git-cliff's author attribution

[lockwobr]

Summary

Our GitHub Release notes credit nobody. Every bullet is a bare subject line with no author and no PR link, so a release page that represents dozens of contributed changes reads as if it appeared from nowhere. External contributors get nothing back for a merged PR, and a reader who wants the discussion behind a line has no path to it.

See operator/v0.18.0: ~90 bullets, zero attribution, zero links.

Root cause

cliff.toml already has the attribution clause in its template (line 40):

{% if commit.remote.username %} by [@{{ commit.remote.username }}](https://github.com/{{ commit.remote.username }}){%- endif %}

commit.remote.username is only populated by git-cliff's GitHub integration, which needs a [remote.github] config (or inferred origin) plus a token, and which --offline explicitly disables. Both release workflows pass --offline:

• .github/workflows/release.yml:71 and :86
• .github/workflows/cli-release.yaml:84 and :99

So the clause never renders and the template silently no-ops.

The --offline flag is correct where it came from. scripts/gen-changelog.sh:170-173 documents the reasoning: the API enrichment panics on an unauthenticated 403, and by [@user] links are not wanted in the committed CHANGELOG.md files. That reasoning was then copied into the release workflows, where neither half applies: CI has a GITHUB_TOKEN, and release notes are exactly where credit belongs.

Second contributor to the same problem: cliff.toml's preprocessor { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" } strips the trailing (#472) from every squash-merge subject, removing the last remaining pointer back to the PR. Committed changelogs may want that; release notes do not.

Proposal

Split the release-notes rendering from the committed-changelog rendering, rather than sharing one config and one flag set:

• Drop --offline in the two release workflows and export GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} for those steps, so commit.remote.username resolves
• Add [remote.github] (owner NVIDIA, repo nodewright) to cliff.toml so resolution does not depend on how the runner's origin remote is spelled
• Keep the PR number, or re-add it as a link, in release-notes output; keep gen-changelog.sh output unchanged so committed CHANGELOG.md files don't churn
• Consider a "New Contributors" section, or GitHub's own generated Contributors block, appended below the git-cliff body

gen-changelog.sh and the committed changelogs stay exactly as they are.

Acceptance criteria

• Release notes for a cli/* and an operator/* tag show by [@user] on each bullet
• Release notes link back to the originating PR
• The generated notes step does not fail or hang when the API is rate-limited or the token is missing; it degrades to today's uncredited output rather than erroring the release
• Committed CHANGELOG.md files are byte-identical before and after the change
• Backfilling credit on already-published releases is explicitly decided (do it, or state that we don't)