chore(release): require curated release notes

scripts/check-release-manifest.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # Validate releases/manifest.json:
 #   - version matches core/archipelago/Cargo.toml
-#   - changelog is non-empty (release notes are mandatory per product policy)
+#   - changelog contains curated release notes, not raw git log output
 #   - every component's download_url exists on disk and matches sha256/size
 #
 # Run on every push from CI, and also locally before publishing a release:
@@ -30,12 +30,42 @@ if [ "$MANIFEST_VERSION" != "$CARGO_VERSION" ]; then
 fi
 ok "version matches: $MANIFEST_VERSION"
 
-# Release notes mandatory — ships stuff nobody can read otherwise.
-CHANGELOG_COUNT=$(python3 -c "import json; print(len(json.load(open('$MANIFEST'))['changelog']))")
-if [ "$CHANGELOG_COUNT" -eq 0 ]; then
-    fail "changelog is empty — every release MUST have release notes"
-fi
-ok "changelog has $CHANGELOG_COUNT lines"
+# Release notes mandatory — ships stuff nobody can read otherwise. Require
+# curated user/operator-facing notes and reject raw `git log --oneline` output.
+NOTES_CHECK=$(python3 - "$MANIFEST" <<'PY'
+import json
+import re
+import sys
+
+manifest = sys.argv[1]
+notes = json.load(open(manifest)).get("changelog", [])
+if len(notes) < 3:
+    print(f"FAIL: changelog has {len(notes)} lines; need at least 3 curated release-note bullets")
+    sys.exit(0)
+
+bad = []
+for note in notes:
+    text = str(note).strip()
+    if not text:
+        bad.append("empty release-note entry")
+    if len(text) < 40:
+        bad.append(f"too short: {text!r}")
+    if re.match(r"^[0-9a-f]{7,40}\s+", text):
+        bad.append(f"raw commit hash entry: {text!r}")
+    if re.match(r"^(feat|fix|chore|docs|test|refactor|build|ci|perf)(\([^)]+\))?:\s", text):
+        bad.append(f"raw conventional-commit entry: {text!r}")
+
+if bad:
+    print("FAIL: release notes must be curated user/operator-facing bullets, not raw git log lines:\n" + "\n".join(bad))
+else:
+    print(f"OK: changelog has {len(notes)} curated lines")
+PY
+)
+case "$NOTES_CHECK" in
+    OK:*) ok "${NOTES_CHECK#OK: }" ;;
+    FAIL:*) fail "${NOTES_CHECK#FAIL: }" ;;
+    *) fail "unexpected release-note validation output: $NOTES_CHECK" ;;
+esac
 
 # Each component: the artifact on disk under releases/v<version>/ must match
 # the declared sha256 and size_bytes.