fix(release): span the final-release changelog since the previous stable tag

[joshua-temple]

Problem

Auto-promoted final releases publish with an empty changelog (just ## Changelog), while rc/dryrun prereleases get full changelogs.

Auto-promote tags the newest candidate's exact commit as the final vX.Y.Z, so v0.8.0 and v0.8.0-rc.7 are the same commit (58c3d30). release.yaml runs GoReleaser with GORELEASER_CURRENT_TAG set but not GORELEASER_PREVIOUS_TAG, so GoReleaser auto-detects the previous tag as the immediately preceding semver tag (the candidate, same commit). The compare range is empty, so the changelog is empty. Older finals (v0.7.0) escaped only because commits happened to land between rc and final.

Fix

For a final (non-prerelease) current tag, compute the previous non-prerelease tag and pass it as GORELEASER_PREVIOUS_TAG, so the final changelog spans the whole candidate cycle (for example v0.7.0..v0.8.0). Prerelease tags (-rc. / -dryrun.) leave it unset and keep their incremental changelogs.

• .github/scripts/previous-stable-tag.sh: prints the greatest final vX.Y.Z tag strictly below a given tag (skipping rc/dryrun), or empty if none. shellcheck clean.
• .github/workflows/release.yaml: a pre-GoReleaser step runs the script for final tags and writes GORELEASER_PREVIOUS_TAG to $GITHUB_ENV only when non-empty; the checkout already uses fetch-depth: 0 and the step also git fetch --tags --force. github.ref_name is passed via env: (no shell interpolation).
• internal/release/previous_stable_tag_test.go: drives the script over injected tag sets (prior stable skips rc/dryrun; only-prereleases-below returns empty; first stable returns empty; multiple stables returns highest below; prerelease current resolves the stable below its base).
• Docs: release-orchestration.md documents the final-release changelog range.

Verification

• shellcheck clean; actionlint .github/workflows/release.yaml clean.
• go build ./..., go test ./... (2371 passed), golangci-lint run ./... all clean.
• Local GoReleaser dry-run (git-backed changelog config, offline) proves the mechanism:
  • GORELEASER_CURRENT_TAG=v0.8.0 with previous unset or empty string -> previous_tag=v0.8.0-rc.6, changelog is 1 line (empty).
  • GORELEASER_PREVIOUS_TAG=v0.7.0 -> previous_tag=v0.7.0, 32-line changelog across the cycle.
  • Confirms both the bug and that an empty GORELEASER_PREVIOUS_TAG is treated as unset (auto-detect), so passing empty on the prerelease path is safe. The real config uses changelog.use: github (GitHub compare API), for which GORELEASER_PREVIOUS_TAG is the documented previous-tag override.