publish.yml refuses to create a release without a per-version CHANGELOG
section. Records the two §17.1 fixes, their evidence, and the accepted
residuals.