build(release): Generate the changelog automatically with Craft

[runningcode]

📜 Description

Craft has been configured with changelogPolicy: auto for years, but auto mode only generates a section when the ## Unreleased section is empty. Every PR hand-wrote its entry there (enforced by Danger), so the generation path never actually ran.

This switches us to the flow sentry-dart uses: the PR title is the changelog entry, and Craft categorizes it at release time.

• .github/release.yml (new) — categories matching the sections this changelog already uses (Breaking Changes / Security / Features / Fixes / Performance / Dependencies / Internal Changes), each with a semver field so craft prepare auto can derive the version bump. Renovate and Dependabot are excluded, since Renovate only bumps this repo's own build tooling; the bumps users care about (CLI, Android SDK, ComposablePreviewScanner) come from getsentry/github-workflows/updater as github-actions[bot] and land under Dependencies.
• .craft.yml — migrate off the deprecated changelogPolicy key to changelog.policy, and raise minVersion to 2.30.1, which is exactly the craft SHA both workflows already pin. Craft 2.21+ bumps versions from the publish targets when no preReleaseCommand is set, and the maven target can't bump a Gradle build, so scripts/bump-version.sh is now named explicitly rather than relied on as a default.
• update-deps.yml — changelog-entry: false on all three updaters, and CHANGELOG.md — drop the stale ## Unreleased section. Either one left in place keeps that section non-empty and silently suppresses generation for the next release. Those four entries are regenerated from their PR titles.
• danger.yml — removed. Its changelog rule hard-fails any feat:/fix:/perf:/security: PR without a manual entry, and the shared action has no input to disable that one check.

💡 Motivation and Context

Hand-written entries are a recurring source of merge conflicts, rebase fixups (docs(changelog): Add missing entry…, chore(changelog): …), and PRs that get blocked on a one-line edit.

💚 How did you test it?

Replayed the last 60 merged PRs through Craft's own categorization logic with this config. Sample of the generated output:

### Features
- (instrumentation) Add reverse variant DSL for feature overrides
- (snapshots) Emit canvas_theme in snapshot sidecar (EME-1241)

### Fixes
- (proguard) Unwrap analytics variant for optimization

### Performance
#### Instrumentation
- [Generated metadata 2] Generate manifest metadata
- [Generated metadata 1] Generate class availability

### Dependencies
- Update CLI to v3.7.0
- Update Android SDK to v8.54.0

20 of the 60 were excluded (all Renovate), and 2 landed in Craft's catch-all Other section because their titles had no conventional-commit prefix — nothing is dropped silently.

Also verified against craft's source at the pinned SHA cd1e829 that it is exactly 2.30.1, that its schema accepts the changelog object form, and that preReleaseCommand still routes to scripts/bump-version.sh.

📝 Checklist

• I reviewed the submitted code
• I added tests to verify the changes
• I updated the docs if needed
• No breaking changes

🔮 Next steps

• Removing Danger also drops its "pin actions to a commit SHA" check. Worth restoring separately with zizmor or actionlint if we want that enforced.
• build(verification): Verify compiler plugin dependencies with PGP (GRADLE-116) #1423 / build(verification): Run compiler plugin verification in CI (GRADLE-116) #1430 will land under Internal Changes rather than Security next release, since they're build(verification): commits. Applying the existing Security label to them puts them back — label matching takes precedence over the title pattern.

[0xadam-brown]

Lgtm 👍

My clanker pointed out that the following from renovate.json has now gone stale and can be removed:

{
      "description": "Deps bundled into the published plugin are user-facing, so use a fix: title to make Danger require a CHANGELOG entry. Everything else stays build(deps): and is skipped.",
      "matchPackageNames": [
        "org.ow2.asm:asm-util",
        "org.ow2.asm:asm-commons"
      ],
      "semanticCommitType": "fix"
    }