ci: let the semver gate see a break on a push, not only on a pull request

[vyncint]

main is red right now, and this is why.

github.event.pull_request does not exist on a push, so

release-type: ${{ contains(github.event.pull_request.labels.*.name, 'breaking') && 'major' || 'patch' }}

silently yields patch there. #137 merged a deliberate break carrying the breaking label, was green as a pull request, and turned main red on the very next push — and would have stayed red until 0.7.0 moved the baseline.

The fix

The label was the wrong signal for a push. A break is declared twice now, and the second declaration is the CHANGELOG: a ### Breaking heading under ## [Unreleased], scoped to that section so a heading in an already-released one does not count.

That is the document a release is cut from, which makes the push gate mean something rather than nothing: merge a break without recording it and this fails. A better rule than the label alone, which said nothing at all after the merge.

Exercised, not assumed

tree	release type
[Unreleased] contains ### Breaking	major
it does not	patch
the heading appears only under [0.6.1]	patch

The third case is the one that makes it a real predicate rather than a grep for a string that appears somewhere in a 1200-line file.

docs/RELEASING.md records both declarations and why each exists.

Signed-off-by: Vyncint Ng 115854244+vyncint@users.noreply.github.com