docs: add CHANGELOG.md and automate GitHub Releases (#61)

## Summary

- Adds `CHANGELOG.md` (Keep a Changelog format) documenting all releases
from v2.1.0 through v2.5.5
- Adds a **Create GitHub Release** step to the `merge` job in
`docker-publish.yml` — on each version bump merge, the pipeline extracts
the relevant section from `CHANGELOG.md` and publishes a GitHub Release
automatically
- Satisfies OSPS-BR-04.01: *"When an official release is created, that
release MUST contain a descriptive log of functional and security
modifications"*

## How it works

The pipeline step extracts release notes using `awk` to find the `##
[X.Y.Z]` section in `CHANGELOG.md` and pipes it to `gh release create
--notes-file -`. The step is idempotent — if the release already exists
(e.g. on a workflow re-run) it skips without error.

**Workflow:** going forward, update `CHANGELOG.md` in the same PR that
bumps the version in `packages/stdio/package.json`. The next merge to
main will publish the GitHub Release automatically.

## Test plan

- [ ] `CHANGELOG.md` renders correctly on GitHub
- [ ] `npm run type-check` and `npm run build` pass
- [ ] After merge + next version bump, verify GitHub Release is created
with correct notes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Paradoxbound <paradoxbound@paradoxbound.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people