OverClick 0.3.22

OCL-207: release notes are data again, not code run with the repository token.

• The release workflow used to paste this very text into its bash script through a ${{ }} expression. Every backtick ran as command substitution on a runner holding GH_TOKEN, and every double quote ended the argument. v0.3.19 got a Release with each backticked word erased, and v0.3.20 got no Release at all; both were repaired by hand.
• The notes now go from git to a file and from the file to --notes-file. Nothing in a changelog is executed, whatever it contains.
• This Release is the test: if you can read task_update {status: "descartado"} here, backticks and "double quotes" included, the fix works.

Nota do corte: o commit anterior bumpou só os quatro package.json, e o guarda
scripts/verify-release-version.sh recusou a tag — o mesmo esquecimento dos sete
manifestos de plugin que o comentário dele registra do OCL-158. Refeito com
scripts/release-manifests.mjs, que é a lista canônica.