docs: add CHANGELOG.md and automate GitHub Releases

[paradoxbound]

Summary

• Adds CHANGELOG.md (Keep a Changelog format) documenting all releases from v2.1.0 through v2.5.5
• Adds a Create GitHub Release step to the merge job in docker-publish.yml — on each version bump merge, the pipeline extracts the relevant section from CHANGELOG.md and publishes a GitHub Release automatically
• Satisfies OSPS-BR-04.01: "When an official release is created, that release MUST contain a descriptive log of functional and security modifications"

How it works

The pipeline step extracts release notes using awk to find the ## [X.Y.Z] section in CHANGELOG.md and pipes it to gh release create --notes-file -. The step is idempotent — if the release already exists (e.g. on a workflow re-run) it skips without error.

Workflow: going forward, update CHANGELOG.md in the same PR that bumps the version in packages/stdio/package.json. The next merge to main will publish the GitHub Release automatically.

Test plan

• CHANGELOG.md renders correctly on GitHub
• npm run type-check and npm run build pass
• After merge + next version bump, verify GitHub Release is created with correct notes

🤖 Generated with Claude Code