fix(ci): release-please squash-merge auto-tag + populate Release body

[fentas]

Summary

Two long-standing release-flow bugs surfaced cutting v0.4.0 / v0.5.0:

1. release-please-action skips tag-push on squash-merge

The action only fires tag-push when the release PR is merged via "Create a merge commit." This repo squashes everything (per CLAUDE.md), so the action's heuristic finds no merge commit matching its PR's tracked SHA and silently leaves the PR labelled autorelease: pending. Subsequent runs then see untagged release PR outstanding — aborting and refuse to open a new PR.

PR #11 (v0.4.0) and PR #131 (v0.5.0) both required a manual git tag && git push --tags to unblock.

Fix: follow-up step in release-please.yml reads the post-merge .release-please-manifest.json, computes the expected tag, and pushes it if missing. Identifies the source PR by label + title search, swaps the label to autorelease: tagged after tagging. Idempotent — unrelated pushes see the tag exists and exit.

2. GitHub Release body was empty

release.yml used generate_release_notes: false and never passed a body, so even the v0.4.0 Release (built via the existing flow) had a blank description. release-please-action normally populates the Release itself when it tags, but the new squash-merge auto-tag path bypasses that.

Fix: new extract changelog section step in release.yml awks the matching ## [X.Y.Z] section out of CHANGELOG.md and passes it as body_path to softprops/action-gh-release@v3.

After this lands

The v0.6.0 cycle should be hands-off: merge the release-please PR (squash is fine), the auto-tag step pushes v0.6.0, release.yml builds binaries AND creates the Release with populated body — no manual intervention.

Test plan

• awk extraction works locally — extracted v0.4.0 (58 lines) and v0.5.0 (151 lines) sections from CHANGELOG.md.
• auto-tag step's idempotency: when v0.5.0 tag already exists, the step's two if-guards short-circuit out.
• PR identification: gh pr list --state merged --label "autorelease: pending" --search "in:title chore release" correctly returns the most recent release PR.
• End-to-end: cuts v0.6.0 from the next release-please PR merge without manual steps. Verified next release cycle.
• Backfill v0.4.0 + v0.5.0 release bodies (separate manual step — once this PR lands, future releases auto-populate; the existing two need a one-time gh release edit).

🤖 Generated with Claude Code

[fentas]

/review-loop complete — 3 rounds, subagent-only

Round	Verdict	Action
1	fix-and-ship	45a55ac — awk extractor switched from regex to literal index($0, hdr) == 1 (regex . wildcards would mis-match RC tags); auto-tag PR query narrowed to --head release-please--branches--master (no out-of-band PR mistakes); defensive git cat-file -e $pr_sha^{commit} before tagging.
2	fix-and-ship	ac616ea — semver regex check on manifest version. A corrupt/empty manifest emits null from jq; without the guard the script would push a real PR SHA tagged as vnull.
3	ship	Final pass; YAML parses, awk pattern verified against real CHANGELOG, semver regex empirically validated for stable + rc + build-metadata + rejects null/garbage.

Ready for merge. The PR fixes BOTH the squash-merge auto-tag gap AND the empty Release body — after this lands, v0.6.0 should cut hands-off.

🤖 /review-loop with Claude Code