[codex] harden release workflow automation

[lbliii]

Summary

Harden Kida's release automation based on the 0.10.0 release run.

• keep release-created Release Notes runs from overwriting curated GitHub release notes
• limit changelog regeneration/commit behavior to explicit manual workflow_dispatch
• push manual changelog updates to an explicit target branch instead of relying on detached checkout state
• make make gh-release fail loudly for dirty worktrees, wrong HEAD, existing releases, and mismatched remote tags
• document the release automation gate and post-release verification checklist

Why

During 0.10.0, the package publish workflow succeeded, but the release-notes workflow failed after trying to commit changelog updates from a detached release checkout. The generated notes also overwrote the curated GitHub release body. This keeps release events useful for dogfooding/reporting while preserving the human-authored release notes as the published contract.

Steward Notes

• Consulted root AGENTS.md, .github/AGENTS.md, and docs/AGENTS.md.
• Release/publish behavior is intentionally touched and documented.
• Permissions are not expanded.
• No schema, package, runtime, or public API behavior changes.

Validation

• YAML parse check: ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release-notes.yml"); puts "yaml ok"'
• Extracted gh-release recipe shell syntax: bash -n /private/tmp/kida-gh-release-check.sh
• git diff --check
• pre-commit hook check yaml passed during commit