chore(release): fold the post-merge fixes into 0.28.0

[bahdotsh]

0.28.0 merged in #509 (d3aed18) but was never tagged: no v0.28.0 tag, nothing on npm, crates.io or PyPI. Since then #516, #515, #517 and #518 landed, and #515/#516 opened a new [Unreleased] above [0.28.0].

This folds them into 0.28.0 instead of cutting 0.28.1 over a number that never shipped:

• CHANGELOG: the five [Unreleased] entries move to the top of 0.28.0's ### Fixed and ### Added; no empty [Unreleased] left. The summary blockquote gains the Android Hello / 15 s neighbor_lost sentences and a paragraph for the dense-cluster forwarding fix, the probe outbox fix and native_event_gap.
• UPGRADING §26: Android neighbor_lost timing, and the new native_event_gap diagnostic.
• No version file changes: every manifest already reads 0.28.0. scripts/generate-third-party-notices.sh produces no diff.
• fix(bindings): UIScene lifecycle for RN example apps on iOS 26+ #517 (example apps only) and fix(bindings): a closed hello-mapped link gives the peer back its live address, and each link keeps its own hello #518 (a fix to unreleased fix: close the four open issues (#510, #512, #513, #514) #516 behaviour) need no entry of their own.

After merge: push v0.28.0-rc.1 first (the #464 staged-publish fix has never run on a real tag), then v0.28.0, then the Swift pull workflow.