chore(ci): plumb semantic-release notes into GitHub Release body (#5317)

Stage A (#prior PR) added @semantic-release/release-notes-generator to
the plugin chain and a manual backfill workflow to validate the format.
This change wires the same notes into the production release pipeline so
future releases on develop/main come with a populated GH Release body
instead of an empty page.

- release.yml: capture new_release_notes from the plan job's
cycjimmy/semantic-release-action step into a release_notes job output
using a heredoc with a random delimiter. SR_NOTES is passed via env and
emitted with printf (not echo) so attacker-influenced commit bodies / PR
titles can't be interpolated as shell. The workflow_dispatch re-cut path
skips semantic-release entirely, so release_notes is the empty string in
that case - the operator can follow up with the backfill-release-notes
workflow to populate the body afterwards.

- release-shared.yml: new optional release_notes workflow_call input,
wired as the body of the softprops/action-gh-release step that creates
the draft release. No generate_release_notes: true - the action appends
GitHub's auto notes to any supplied body, which would duplicate content.

## What kind of change does this PR introduce?

Bug fix, feature, docs update, ...

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: avallete

.github/workflows/backfill-release-notes.yml

@@ -1,6 +1,22 @@
 name: Backfill release notes
 
 on:
+  workflow_call:
+    inputs:
+      tag:
+        description: Release tag to refresh (e.g. v2.100.1)
+        required: true
+        type: string
+      apply:
+        description: Update the GitHub release body (otherwise dry-run only)
+        required: false
+        type: boolean
+        default: false
+      non_blocking:
+        description: Do not fail the workflow run when backfill fails (release pipeline)
+        required: false
+        type: boolean
+        default: false
   workflow_dispatch:
     inputs:
       tag:
@@ -19,6 +35,7 @@ permissions:
 jobs:
   backfill:
     runs-on: ubuntu-latest
+    continue-on-error: ${{ inputs.non_blocking }}
     permissions:
       contents: write
     env:

.github/workflows/release-shared.yml

@@ -332,6 +332,17 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh release edit "v${VERSION}" --draft=false
 
+  # Changelog backfill only needs tag + published GH release (from publish).
+  # Runs in parallel with brew/scoop/smoke; must not gate distribution.
+  backfill-release-notes:
+    uses: ./.github/workflows/backfill-release-notes.yml
+    needs: publish
+    if: ${{ !inputs.dry_run && needs.publish.result == 'success' }}
+    with:
+      tag: v${{ inputs.version }}
+      apply: true
+      non_blocking: true
+
   publish-homebrew:
     needs: publish
     if: ${{ !inputs.dry_run && inputs.publish_brew_scoop }}