changelog: adopt changie fragment files to end CHANGELOG merge conflicts

[iainmcgin]

Why

Every PR that adds an entry to the top of [Unreleased] in CHANGELOG.md
conflicts with every other open PR doing the same, so the merge queue turns into
a sequence of manual changelog rebases (we have hit this repeatedly across the
current server-hardening PR set). This switches to changie's
fragment model: each PR adds a new file under .changes/unreleased/, and
CHANGELOG.md is assembled from .changes/ at release time. New file → no
shared lines → no conflict. It mirrors the buffa adoption (anthropics/buffa#230).

What

Two commits, reviewable separately:

1. Tooling — .changie.yaml (tuned to our Keep a Changelog format:
   bracketed [X.Y.Z], - bullets, multi-line bodies with a 2-space hanging
   indent), .changes/header.tpl.md, the four changelog-* Taskfile tasks
   (install-changie downloads the pinned binary to .local/bin/,
   changelog-new / -batch / -merge), a check-changelog CI job (same
   shape as check-generated-code), a CONTRIBUTING section, and .local/ added
   to .gitignore.
2. Migration — the 14 released sections 0.2.0…0.8.0 split verbatim into
   .changes/<ver>.md, and CHANGELOG.md regenerated from those. The released
   history round-trips byte-identical (verified with diff).

Unlike buffa, connect-rust's CHANGELOG.md has no per-version compare-link
footers, so footerFormat is omitted to keep the migration byte-identical
(compare-links can be added later as a separate, intentional change).

Sequencing — finalized

The plan this PR originally waited on is complete: v0.8.0 shipped
(tag v0.8.0, 2026-07-01), and this branch has been rebuilt on the
post-release main — the tooling commit rebased as-is, and the migration
regenerated from the released changelog so the [0.8.0] section rides in
.changes/0.8.0.md like every other released version. changie merge
plus the check-changelog diff (the exact CI job commands) pass locally
with a byte-identical round-trip from ## [0.8.0] onward; the header
gains the fragment-workflow note.

After this lands, contributors add .changes/unreleased/*.yaml fragments via
task changelog-new instead of editing CHANGELOG.md (which becomes generated).

Validation

• changie merge is idempotent; check-changelog passes on the committed tree.
• Released history (## [0.x]…EOF) is byte-identical to main.
• task --list parses; .changie.yaml and ci.yml are valid YAML.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}