fix(release): validate release artifacts

[steipete]

Summary

• embed GoReleaser's computed version in packaged eightctl version output
• publish the matching finalized changelog section as GitHub Release notes and reject headings still marked Unreleased
• validate manual release tags before a detached checkout, pin GoReleaser v2.16.0, and add CI smoke coverage for notes and artifacts
• refresh selected stable Go modules (go-toml/v2 2.4.2 and x/tools 0.47.0)

Proof

• make fmt
• actionlint
• shellcheck scripts/release-notes
• go test -race ./...
• make coverage (85.1%)
• golangci-lint run ./...
• go vet ./...
• govulncheck ./... (no vulnerabilities)
• go mod verify && go mod tidy -diff
• goreleaser release --snapshot --clean (6 binaries, 6 archives; packaged version matched metadata; packaged CLI help ran)
• Codex autoreview: clean after fixing its release-heading gate finding
• public model identifier gate: PASS; no model-bearing diff

Provider-live API proof is not applicable to this release-tooling-only change; the built release artifact is the affected runtime boundary.

[steipete]

Landed as 55a0486.

Proof on exact PR head b4e26d61538aba780d69b187c3123bf63a73cc97:

• make fmt; actionlint; shellcheck scripts/release-notes
• go test -race ./...; make coverage (85.1%); golangci-lint run ./...
• go vet ./...; govulncheck ./... (no vulnerabilities); go mod verify; go mod tidy -diff
• goreleaser release --snapshot --clean: 6 binaries and 6 archives; packaged version matched GoReleaser metadata; packaged CLI help ran
• Codex autoreview: clean after accepting and fixing the stale Unreleased heading gate
• hosted CI and GitGuardian: green; https://github.com/steipete/eightctl/actions/runs/28514844007
• public model identifier gate: PASS; no model-bearing diff

Caveat: no Eight Sleep credential was available for provider-live API calls. This change only touches release/dependency tooling, so the built release artifact was the applicable live boundary.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4e26d6153

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Stop disabling custom release notes

For both tag pushes and manual releases this passes the extracted notes to GoReleaser, but .goreleaser.yaml still has changelog.disable: true; GoReleaser's docs for that setting say it will ignore files passed via --release-notes and render an empty changelog. As a result, the new validation succeeds while the GitHub Release body is empty, so enable the changelog before relying on this flag.

Useful? React with 👍 / 👎.