fix: emit custom changelog as a job-level reusable workflow call

[joshua-temple]

Problem

The custom changelog path (changelog.workflow) was emitted as a step inside the finalize job:

- name: Generate Changelog (Custom)
  id: changelog
  uses: .github/workflows/cl.yaml      # reusable workflow path, no @ref, not normalized
  with:
    base_sha: ${{ needs.setup.outputs.base_sha }}
    ...

Two hazards:

• 7a (rejected at parse): a reusable workflow cannot be invoked as a step uses:. GitHub Actions parses it as an action ref and rejects it (missing @ref); the path was also not normalized.
• 7b (silently wrong): the step passed base_sha: ${{ needs.setup.outputs.base_sha }}, but the setup job declares changelog_base_sha, not base_sha. That value was empty at runtime.

Fix

Because a reusable workflow is invalid as a step uses:, fixing 7a forces hoisting the custom changelog into its own job (the built-in changelog path is a real step and stays a step). The new changelog job:

• calls the reusable workflow via a normalized job-level uses: ./.github/workflows/...
• depends on setup and passes changelog_base_sha/head_sha/repo keyed to the setup job's real outputs (fixes 7b)

The finalize job now lists changelog in its needs:, and the release step consumes needs.changelog.outputs.changelog for the custom case (steps.changelog.outputs.changelog for built-in).

Verification

• New TestGenerator_FinalizeJob_CustomChangelog assertions: job-level uses:, normalized path, changelog_base_sha keyed to the real setup output, release reads needs.changelog.outputs.changelog; asserts the old step name and base_sha reference are gone.
• New TestCustomChangelog_Actionlint: runs actionlint over the generated workflow and reports no issues (proves 7a/7b are gone).
• New e2e scenario 18-custom-changelog.yaml exercises a custom changelog reusable workflow end to end.
• go build ./... && go test ./... && golangci-lint run ./... all green; go build/go vet green in e2e/.