fix: make release changelog ownership deterministic

[tensornull]

Problem

Release Please owns the newest dated changelog section, but the repository also maintained an unmanaged Unreleased heading. Release Please correctly inserted 0.1.4 before that heading, and the canonical-history gate then rejected the generated layout. The immutable release-evidence parser also relied on natural-language workflow labels, so Markdown variants could disguise a contradictory Actions run.

Fix

• make CHANGELOG.md release-only and reject any prose-level Unreleased H2, including CommonMark indentation and formatting variants
• accept Release Please's native dated heading as the newest canonical section
• bind every Actions URL in historical evidence to either the canonical publication identity or an exact ancillary workflow-reference marker
• require canonical Actions URL boundaries and reject malformed, unused, duplicate, undeclared, or contradictory references
• document the permanent Release Please/CHANGELOG ownership rule

Verification

• uv sync --locked
• Ruff check and format check
• Pyright strict
• 570 passed, 1 deselected non-live pytest
• changelog/document mutation tests
• version, public-preview, releasable, secret, and workflow semantic gates
• actionlint 1.7.12
• wheel/sdist build, twine, artifact inspection, clean installs, README examples
• copied standalone repository verification
• git diff --check

This PR contains no runtime API changes and remains within 0.1.x release-process maintenance.