feat(release): group the changelog by conventional-commit type

[joshua-temple]

Problem

The GoReleaser changelog rendered as a single flat commit list. There was no
grouping by commit type, so features, fixes, dependency bumps, and CI changes
were all interleaved.

Fix

Add a changelog.groups list to .goreleaser.yaml: Features, Bug Fixes,
Performance, Refactors, Dependencies, CI & Build, and a catch-all Other
section, ordered in that sequence. GoReleaser assigns each commit to the
first group whose regexp matches, evaluated in order sequence, so
Dependencies is ordered ahead of CI & Build to make sure a dependency bump
lands in its own section instead of being swept into CI & Build.

Note on the Dependencies regexp: this repo's actual dependency-bump commits
come from Dependabot as chore(deps): bump ..., not build(deps): or a bare
deps: type. A regexp anchored on deps/build(deps) as the commit type
does not match that shape, so the Dependencies group instead matches any
commit whose scope is literally (deps), regardless of type
(^.*?\(deps\)!?:.+$). This was confirmed by running the dry run below.

The existing filters.exclude list (docs/test/chore/merge commits) is
unchanged, so the automated chore: update state [skip ci] fleet churn and
plain docs/test noise stay out of the changelog.

Verification

Ran a real dry run over the v0.7.0..v0.8.0 range with GoReleaser installed
locally:

export GITHUB_TOKEN=$(gh auth token)
GORELEASER_CURRENT_TAG=v0.8.0 GORELEASER_PREVIOUS_TAG=v0.7.0 \
  goreleaser release --skip=publish,validate,announce,sign,sbom --clean

(--snapshot skips changelog generation entirely in this GoReleaser version,
so the non-snapshot form with skips was used instead, pointed at a
GITHUB_TOKEN from gh auth token since changelog.use: github calls the
GitHub API.)

Observed grouped output (dist/CHANGELOG.md), trimmed to the section
headers and a few entries per section:

## Changelog
### Features
* feat(ci): surface failing-job root cause in the PR failure comment (@joshua-temple)
* feat(release): sign release artifacts and add build provenance (#395) (@joshua-temple)
### Bug Fixes
* fix(ci): label the failure-report log region as excerpt not tail (@joshua-temple)
* fix(config): charset-validate dispatch_input names and choice options (#454) (@joshua-temple)
* ... (11 more fix commits)
### Dependencies
* chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (#404) (@dependabot[bot])
* chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.3.0 (#428) (@dependabot[bot])
* chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#429) (@dependabot[bot])
### CI & Build
* ci(e2e): add scheduled act runner image repin (#426) (@joshua-temple)
* ci(fleet): guard example-suite tooling pins against floor drift (#427) (@joshua-temple)
* ... (5 more ci commits)
### Other
* docs(cli-reference): document status, rollback, and graph command families (#421) (@joshua-temple)
* docs(configuration): add rows for action_pins, pin_mode, release_trigger, validate_check, merge_queue (#424) (@joshua-temple)
* docs(hotfix): document orphan self-heal, correct stale reserved-shape comments, add callbacks matrix row (#425) (@joshua-temple)
* test(e2e): reuse config.TrunkConfig in the scenario harness (#422) (@joshua-temple)
* test(generate): make actionlint normalization test hermetic (#444) (@joshua-temple)

No commit landed in both Dependencies and CI & Build, confirming the
ordering resolves the overlap correctly. No Performance or Refactors commits
existed in this range, so those sections simply did not render, which is
expected GoReleaser behavior for an empty group.

Also ran goreleaser check (clean) and yq '.changelog' .goreleaser.yaml
to confirm the YAML structure.

go build ./... passes; no Go code was touched.