feat(changelog): ingest GitHub releases and RSS changelog feeds

[CrisSTEM]

Summary

This PR adds live changelog ingestion for the changelog source kind in the v0.3.0 runtime.

It supports two documented binding modes:

• mode = "github_releases"
• mode = "rss"

The fetcher normalizes GitHub release events into content_items with item_type = "release" and RSS changelog entries into content_items with item_type = "changelog_entry". It also adds deterministic test coverage for registry wiring, success paths, rerun dedupe, and malformed upstream responses.

Linked issue(s)

• Closes feat(changelog): ingest GitHub releases and RSS changelog feeds #32

Milestone fit

This PR completes the changelog ingestion slice planned for v0.3.0 and helps finish the first live ingestion baseline for SignalScope.

It stays inside milestone scope by:

• keeping the implementation config-driven
• persisting append-only content items through the shared storage contract
• reusing the existing dedupe model for reruns
• explicitly deferring scheduler logic, alerting, derived processing, and non-documented changelog providers

What changed

• registered changelog in the default fetch registry
• added a dedicated changelog fetcher for:
  • GitHub releases via mode = "github_releases"
  • RSS changelog feeds via mode = "rss"
• normalized non-draft GitHub releases into content_items with item_type = "release"
• normalized RSS feed items into content_items with item_type = "changelog_entry"
• reused the shared content_items dedupe contract so reruns do not insert previously seen items again
• added deterministic httptest coverage for:
  • default-registry wiring
  • GitHub releases success
  • RSS success
  • rerun dedupe
  • malformed GitHub JSON
  • malformed RSS XML
• updated runtime tests so the “no fetcher registered” path remains covered with an unimplemented source kind
• documented v0.3.0 changelog runtime notes in docs/configuration.md

Out of scope

• release delta heuristics or derived “new release after silence” logic
• scheduler execution and cron-style orchestration
• alert evaluation, alert feed read models, and dashboard/API work
• Atom-specific parsing beyond the documented RSS mode
• app-store, social, or package-manager changelog adapters

Validation

Mark what you actually ran:

• python3 ./scripts/trim-whitespace.py --check
• go vet ./...
• go test ./...
• make ci
• Manual CLI verification was performed if runtime behavior changed

Manual CLI verification:

• go run ./cmd/signalscope fetch --config configs/demo/blockstream --db /tmp/signalscope-v0.3.0.db --source changelog

Documentation impact

• No docs update needed
• README.md
• SPEC.md
• docs/
• repository governance docs (AGENTS.md, CONTRIBUTING.md)
• CHANGELOG.md
• release notes

Reviewer focus

• internal/fetch/changelog.go normalization and shared dedupe behavior
• internal/fetch/changelog_test.go rerun dedupe and fixture-driven upstream coverage
• internal/fetch/runtime.go and internal/fetch/runtime_test.go registry wiring and unregistered-source expectations
• docs/configuration.md runtime notes for the new changelog source behavior

Auditability checklist

• Branch name follows project convention
• PR scope matches the linked issue and milestone
• Commits were pushed progressively, not as one final dump
• Relevant tests were added or updated for behavior changes
• No secrets or sensitive credentials were introduced
• Deferred follow-up work is documented explicitly
• Unimplemented work is not implied as completed

Notes for merge

Preferred merge method:

• Issue PRs: Rebase and merge
• Release aggregation PRs: Merge commit
• Use Squash and merge only when the branch became noisy and preserving intermediate commits no longer adds value