ci(release): generate draft notes and open the post-release sync PR

[johnny4young]

Summary

Two release chores were manual on every release and both bit during v1.6.0:

1. Draft notes. release.yml created the draft with a one-line placeholder, and the notes were written by hand at promotion time. scripts/release-notes.mjs now renders them from the version's dated CHANGELOG section, in the format used for 1.5.1/1.6.0:

   • an HTML comment where the maintainer adds a highlights paragraph (invisible if forgotten);
   • the CHANGELOG body and the full-changelog link;
   • Downloads and trust lines only for the platforms actually built. The macOS notarized/ad-hoc and Windows signed/unsigned wording comes from whether the signing secrets were present (passed as booleans; no secret values reach the script).

2. Post-release website sync. After publication the release-event website deploy failed its recipe check, because the site still pinned the previous CLI, until a sync PR was written by hand (docs(website): sync published v1.5.1 surfaces #216, docs(website): sync published v1.6.0 surfaces #250). The new Post-release sync workflow (on release: published, plus workflow_dispatch):

   • regenerates the Homebrew/winget manifests from the published SHA256SUMS.txt;
   • pins the EN/ES recipes with scripts/pin-public-cli-version.mjs;
   • runs the website sync:release and sync:content;
   • opens release-sync/vX.Y.Z with a body that says to merge only after npm is public.

   PRs created with GITHUB_TOKEN start no workflows, so it dispatches ci.yml on the branch; ci.yml gains workflow_dispatch for that (PR-only jobs skip under dispatch).

The tag is validated (^v\d+\.\d+\.\d+$, published, not draft) before any use. RELEASE.md and the distribution runbook describe both steps.

Validation

• tests/scripts/releaseNotes.test.ts (new, 8 tests): section extraction (dated only, empty, dot-not-wildcard, real 1.6.0 section), signed/unsigned trust lines, platform filtering, and recipe pin rewriting.
• node scripts/release-notes.mjs --tag v1.6.0 --mac-notarized reproduces the structure of the hand-written 1.6.0 notes; an unknown tag fails with a clear message.
• Ran the workflow's regeneration commands locally for v1.6.0: manifests, recipes and release snapshot came out identical to what docs(website): sync published v1.6.0 surfaces #250 merged. Only unreleased.json drifted, from post-release commits.
• Dry-ran the PR-body heredoc after YAML indentation stripping.
• actionlint on ci/release/post-release-sync is clean; tests/docs + distribution manifest tests: 220 passed; lint and knip clean.
• The workflows themselves only execute on the next release; first real run is v1.6.1/v1.7.0.