changelog: adopt changie fragment files to end CHANGELOG merge conflicts

[iainmcgin]

Why

Every PR that adds an entry to the top of [Unreleased] in CHANGELOG.md
conflicts with every other open PR doing the same, so the merge queue turns into
a sequence of manual changelog rebases (we have hit this repeatedly across the
current server-hardening PR set). This switches to changie's
fragment model: each PR adds a new file under .changes/unreleased/, and
CHANGELOG.md is assembled from .changes/ at release time. New file → no
shared lines → no conflict. It mirrors the buffa adoption (anthropics/buffa#230).

What

Two commits, reviewable separately:

1. Tooling — .changie.yaml (tuned to our Keep a Changelog format:
   bracketed [X.Y.Z], - bullets, multi-line bodies with a 2-space hanging
   indent), .changes/header.tpl.md, the four changelog-* Taskfile tasks
   (install-changie downloads the pinned binary to .local/bin/,
   changelog-new / -batch / -merge), a check-changelog CI job (same
   shape as check-generated-code), a CONTRIBUTING section, and .local/ added
   to .gitignore.
2. Migration — the 13 released sections 0.2.0…0.7.0 split verbatim into
   .changes/<ver>.md, and CHANGELOG.md regenerated from those. The released
   history round-trips byte-identical (verified with diff).

Unlike buffa, connect-rust's CHANGELOG.md has no per-version compare-link
footers, so footerFormat is omitted to keep the migration byte-identical
(compare-links can be added later as a separate, intentional change).

Sequencing — read before merging

This is prepared as a draft and is deliberately not landable yet. Per
plan, we flush the current open PR set and cut the next connect-rust release
(on buffa 0.8.0) first, then switch changelog tooling.

The current [Unreleased] entries are intentionally not carried into this
branch — they belong to the next release. Finalize at release-cut time:

1. Rebase this branch onto the post-release main.
2. task changelog-batch -- 0.8.0 is not used here (no fragments yet); instead
   create .changes/0.8.0.md from the cut release's notes (the section that was
   [Unreleased] on main), then task changelog-merge.
3. check-changelog then passes and the PR is landable.

After this lands, contributors add .changes/unreleased/*.yaml fragments via
task changelog-new instead of editing CHANGELOG.md (which becomes generated).

Validation

• changie merge is idempotent; check-changelog passes on the committed tree.
• Released history (## [0.x]…EOF) is byte-identical to main.
• task --list parses; .changie.yaml and ci.yml are valid YAML.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}