feat(release): write reviewed V2 release notes to CHANGELOG.md

[thdxr]

Issue for this PR

None. This is a release-tooling feature.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

V2 releases publish a tag, not a GitHub Release, so the reviewed release notes were only sent to Discord. This PR saves them in a root CHANGELOG.md on v2, newest first, so a site can read them later.

• CHANGELOG.md has a short header. Each entry is ## <tag> — <UTC date> followed by the reviewed notes, unchanged.
• In publish.yml, the release_notes input reaches ./script/publish.ts as the OPENCODE_RELEASE_NOTES environment variable. It is set only when github.ref_name == 'v2', and passing it through the environment means the markdown never goes through shell interpolation.
• In script/publish.ts, a new writeChangelog() runs after git checkout -B v2 origin/v2 on the stable release path. Its entry goes into the existing sync release versions for <tag> [skip ci] commit, so there is no extra commit and no deploy trigger. It skips empty or missing notes, and skips tags that already have an entry, so re-runs are safe.

Follow-ups, not in this PR:

• A /changelog site page that fetches the raw file with stale-while-revalidate.
• Backfilling earlier V2 releases from their Discord announcements or workflow inputs.
• Consumers should split entries on ^## v\d, because a ## heading inside the notes would break a plain split.

How did you verify your code works?

• Extracted writeChangelog() from script/publish.ts and ran it against a copy of CHANGELOG.md. Newer entries were prepended, a duplicate tag was skipped, blank and missing notes wrote nothing, and backticks, $(...) and quotes came through unchanged.
• bun run check (lint and typecheck) passes. Prettier is clean on all three files.
• Not exercised in a real publish run.

Screenshots / recordings

N/A

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊