release cleanup: use CHANGELOG notes and lock release dependencies #345

Summary

Two useful, non-blocking release-maintenance items remain from the broader release-workflow review. Higher-risk work was split into dedicated v0.16 issues so it cannot hide inside a P2 cleanup bundle:

• release: add a non-publishing rehearsal path #355 — non-publishing rehearsal path
• release: generate and sign an SBOM for the shipped wheel only #356 — wheel-scoped, signed SBOM
• release: separate verification from publication and make partial publish recoverable #343 — publication transaction, concurrency, permissions, and recovery
• release: align test selection with CI and set a measured timeout #344 — deterministic test workload and measured timeout

1. Publish the matching CHANGELOG section

The workflow currently publishes a placeholder release note even though CHANGELOG.md contains detailed entries.

Acceptance

• Extract the section matching the release tag and pass it through --notes-file.
• Fail before publication when the matching section is absent.
• Preserve Markdown faithfully and test at least one multi-section changelog.

2. Lock release-time development dependencies

pip install -e ".[dev]" resolves fresh at release time, so the release result can differ from the CI run that approved the commit.

Acceptance

• Release installs from a reviewed constraints file or lock that matches CI.
• The lock/constraints update path is documented and automated.
• A stale or inconsistent lock fails before publication.

Preserve these existing controls

• Actions stay pinned to full commit SHAs.
• The protected pypi environment continues to scope qualification inputs.
• dist/ and qualified-dist/ pre-existence and symlink checks remain.
• Downloads continue to enforce HTTPS-only protocols.
• Qualified wheel filenames remain strict and traversal-safe.
• The tag ↔ package-version check remains, with its rationale.

Split from the original #345 scope during PM review on 2026-08-09.