fix(release): fail closed on local tooling

[GSTJ]

Summary

We now run the installed changelog library directly and guard release tags before updating them. Missing dependencies fail locally, published tags stay untouched, and changelog dates replay consistently.

Details

• Freezes the published v1.3.1 through v1.3.8 notes verbatim while future headings keep git's recorded calendar date.
• Disables same-version npm bumps and replaces the force-tag shell command with a deterministic atomic ref update.
• Refuses to change tags already present on origin, non-release commits, dirty worktrees, and unexpected annotations.
• Adds release-tool controls to every test run for the missing-dependency and tag safety paths.

Testing steps

1. From the root of the checked-out repository, run:

   pnpm install --frozen-lockfile
   pnpm run changelog:check
   pnpm run release:check

2. Confirm the changelog check reports a passing policy and negative control.

3. Confirm the release check reports all controls as passing.

[github-actions]

🎉 Congratulations on making your first pull request in '@gstj/safe-jsx'! We appreciate your contribution and will review it as soon as possible. Thank you for helping us make this project better.