[danielbrownjr]

Summary

v0.5.0 published with a bare DragonSniff v0.5.0 title, and its body was the container/wheel hashes followed by GitHub's generated PR list. That broke the release-title tradition (Watch it breathe, Watch it persist, Mark the moment). Two causes: release.yml hardcoded --title "DragonSniff $RELEASE_TAG", and it silently fell back to --generate-notes whenever docs/releases/<tag>.md was absent. The directory had never been created.

The live v0.5.0 release has already been retitled DragonSniff v0.5.0 — Connect the dots, with its body rendered from docs/releases/v0.5.0.md in this PR. Only the release title and body were edited; the tag, commit, wheel, and images are unchanged.

Contract

• docs/releases/<tag>.md: the first line is the title, # DragonSniff <tag> — <subtitle>; the rest is the body.
• Stable releases: curated notes are required. A new preflight step, release_notes.py check, runs before the tag job and before any promotion. A missing file, missing subtitle, or empty body fails the release before anything is mutated. It deliberately does not add a new stranded-tag path (see Release workflow can strand an annotated tag when a later job fails #50).
• Artifacts: the workflow appends ## Artifacts (wheel, wheel SHA256, version container, immutable sha- container, manifest digest), placed before a trailing ## Full changelog. Curated files may not hand-write one. Only the sha- reference is labelled immutable.
• RCs: curated notes are optional but held to the same rules. Without them, the RC is titled DragonSniff vX.Y.Z-rc.N and uses generated notes after the artifact section. That branch carries an explicit test "$PRERELEASE" = true guard.

Changes

• scripts/release_notes.py (new): check and render
• .github/workflows/release.yml: preflight presentation gate; creation uses the rendered title/body; generated notes only in the guarded RC branch. The existing-release verification path and job ordering are unchanged.
• docs/releases/v0.5.0.md (new): the curated v0.5.0 notes
• docs/releasing.md: documents the contract
• tests/test_release_notes.py (new): 19 tests

Validation

• 277 Python tests with warnings as errors (1 expected skip); 30 JS tests; compileall; git diff --check
• Mutation checks, each caught by the new tests:
  • restored hardcoded title
  • removed RC-only guard
  • --generate-notes on the stable path
  • removed preflight gate
  • v0.5.0 title without a suffix
  • deleted v0.5.0 notes

Does not dispatch a release. #50 is untouched.