ci: land the changelog as soothfast-bot via the broker

[Verdenroz]

What changed

changelog.yml is the first workflow off the App private key. It now asks the broker for a soothfast-bot token after the build has finished, and lands the regenerated file with action/land.sh instead of peter-evans/create-pull-request. The same script will serve the adopter action, so the bot flow is exercised on this repo first.

• Added action/land.sh. Stages PATHS, exits cleanly when nothing changed, commits as APP_SLUG[bot] with a per-command identity, force-pushes to BRANCH with the token on the push URL only, opens or refreshes the PR, and merges with --auto when the default branch has a required-check, review, or merge-queue rule, or immediately when it has none. The push token travels through a credential helper, never a URL, and HEAD is restored after the push. The token is revoked on every exit path.
• Rewrote the changelog job: no App mint, no user-id lookup, checkout with persist-credentials: false, environment: soothfast-bot, permissions contents: read and id-token: write.
• Added concurrency: {group: changelog, cancel-in-progress: true} so only the newest regeneration lands.

Closes #145. Part of #158 and #14.

Why

The changelog bot fires on every merge to master, so it is the cheapest place to prove the broker path on a real ruleset before the other workflows follow. The token is minted after the build on purpose: no step that compiles the tree ever holds a write credential. A cancel between mint and land leaves a one-hour token unrevoked; that is accepted, since the alternative is a stale changelog winning the race #145 describes.

How was this tested

• shellcheck 0.11.0 on action/land.sh and action/bot-token.sh: clean.
• zizmor 1.29.0 on changelog.yml, bot.yml, bot-smoke.yml: no findings.
• bash -n on both scripts.
• Not run end to end: that happens when this merges and the first bot PR fires. If it misbehaves, merge that PR by hand; the revert is this one file.
• make check and make gate were not run for this layer. It changes no Rust.

Checklist

• make check passes (fmt, clippy -D warnings, cargo test --workspace)
• make gate BASE=master passes, or any intentional cost change is explained above
• Tests added/updated for new behavior (not required for docs/CI-only changes)
• Public API items have /// doc comments
• No new dependency, or its justification is included above (see Dependency Policy)
• Docs (README.md, docs/, soothfast:bind/soothfast:claim markers) updated if behavior changed

[soothfast-bot]

soothfast gate

gate: measuring merge-base of origin/master in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.06% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_spec::bench_openapi_diff walltime_median_ns 5177120.0 -> 5177120.0 (+0.0%)
ok    soothfast_spec::bench_openapi_diff allocs 77722 -> 77722 (allowed <= 81608)
ok    soothfast_spec::bench_openapi_diff alloc_bytes 10815487 -> 10815487 (allowed <= 11356261)
ok    soothfast_spec::bench_openapi_document walltime_median_ns 1898703.0 -> 1898703.0 (+0.0%)
ok    soothfast_spec::bench_openapi_document allocs 30152 -> 30152 (allowed <= 31659)
ok    soothfast_spec::bench_openapi_document alloc_bytes 4715065 -> 4715065 (allowed <= 4950818)
ok    soothfast_spec::bench_serialize_yaml walltime_median_ns 6564428.0 -> 6564428.0 (+0.0%)
ok    soothfast_spec::bench_serialize_yaml allocs 74277 -> 74277 (allowed <= 77990)
ok    soothfast_spec::bench_serialize_yaml alloc_bytes 8533615 -> 8533615 (allowed <= 8960295)
ok    soothfast_spec::bench_openapi_diff assert complexity: claimed O(n); growth drift x1.40 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_spec::bench_openapi_document assert complexity: claimed O(n); growth drift x1.48 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_spec::bench_serialize_yaml assert complexity: claimed O(n); growth drift x1.17 over sizes [16, 64, 256] (limit x2.5)
gate: passed (3 item(s))