Automate release-train forward-port (CHANGELOG back to main + next-dev bump)

[justin808]

Background

Follow-up to #4000 / #4018 and PR #4122, which made the release/* final-promotion path executable (stable release[X.Y.Z] from the matching release/X.Y.Z branch + CI-tip validation). PR #4122 deliberately deferred the forward-port automation (this issue) rather than bundle it into a release-critical release.rake change.

What's still manual

The release-train runbook's close-out (step 5) forward-ports the final CHANGELOG collapse back to main and bumps main to the next dev version with hand-run git commands:

git checkout main && git pull --rebase
git cherry-pick -x <changelog-collapse-sha>   # the rc-section collapse commit
git push
# then bump main to the next dev version if not already

During RC stabilization (step 3), each fix that lands on release/X.Y.Z must also be cherry-picked (-x) to main.

Why it wasn't automated in #4122

Its safe shape is conditional, which is why a naive helper is risky:

• Whether to take the version-bump commit at all depends on how far main has drifted — if main is already past the release version (e.g. 17.1.0.dev), cherry-picking the bump-to-17.0.0 commit conflicts and would regress main's version. Only the CHANGELOG changes should be taken in that case (see the step-5 caveat in the runbook).
• It must cherry-pick only the fix / CHANGELOG-collapse commits, never the rc Bump version to …rc.N commits.

It is not a release blocker (nothing aborts), unlike the stable-promotion guard that #4122 resolved.

Proposed helper (sketch)

A rake/script helper (e.g. script/release-forward-port or a rake "release:forward_port[...]") that:

• Takes the fix/CHANGELOG SHAs (or derives them from the release/X.Y.Z branch, excluding Bump version to * commits).
• Cherry-picks them -x onto an up-to-date main (or a PR branch when main is protected).
• Detects the version-drift case and either skips the version-bump commit or takes only the CHANGELOG hunks, surfacing a clear message instead of leaving a conflict.
• Is dry-run-able and idempotent (skips already-forward-ported commits — -x makes them auditable).

Acceptance

• Helper forward-ports release/* fixes to main without dragging rc version-bump commits.
• Handles the main-already-bumped case (CHANGELOG-only) with a clear message rather than a raw conflict.
• Runbook step 3 / step 5 updated to call the helper, keeping the manual steps as the fallback.
• Tested via the throwaway-repo dry-run sequence in the runbook's "Dry-run" section.

Refs

• Release-train branching + phase-tiered merge gating (beta/RC/final) for the batch era #4000, Release-train branching + phase-tiered merge gating (beta/RC/final) #4018, PR Add executable release/* promotion path + CI-tip gate (#4000 follow-up) #4122
• internal/contributor-info/release-train-runbook.md (steps 3 and 5, and the GAP 2 follow-up note)