ci: enforce CHANGELOG entry on release-relevant PRs

[goanpeca]

Problem

The v1.2.0 audit found the [Unreleased] CHANGELOG section was missing entries for merged PRs (#135 file-metadata inputs, #131 cross-bucket copy fix, the SDK ^0.1.0 → ^0.2.0 bump). Nothing in CI enforces a CHANGELOG entry at PR time, so user-facing changes silently accumulate undocumented until someone audits before a release. docs:check-action-yml catches input/output drift, but not "this PR changed behavior and never touched the changelog."

The RELEASE.md pre-release checklist (added in f99990a) is the current manual backstop. This issue tracks automating the root cause.

Proposal

Add a PR-time CI gate that fails when a PR touches release-relevant paths (src/**, action.yml, .github/workflows/**) without also modifying CHANGELOG.md, with a skip-changelog label as the documented escape hatch for pure refactors, test-only, or tooling PRs.

Sketch

• New job (in ci.yml or docs-lint.yml) that runs only on pull_request.
• Compute the changed-file set against the base ref.
• If any path matches src/** / action.yml / .github/workflows/** AND CHANGELOG.md is unchanged AND the skip-changelog label is absent, fail with an actionable message pointing at the [Unreleased] section and the label escape hatch.
• Keep it dependency-light (git diff + a small script), consistent with the existing scripts/*.mjs gates.

Acceptance criteria

• A PR changing src/** / action.yml / workflows without a CHANGELOG edit fails the check.
• Adding the skip-changelog label makes it pass.
• Docs-only / test-only PRs are unaffected.
• The check is documented in CONTRIBUTING.md and referenced from the RELEASE.md checklist so the manual step can point at the automated one.

Out of scope

Semantic validation of changelog content (right section, right wording) stays manual via the RELEASE.md checklist.