feat: add changelog command

[marcus]

Summary

• Adds td changelog for stdout-only markdown generation from git commits.
• Adds git helpers for ref validation, nearest reachable semver tags, and ordered commit listing.
• Adds deterministic changelog grouping for features, fixes, docs, and improvements.
• Updates README and release docs to mention changelog generation.

Tests

go test ./internal/git ./internal/changelog ./cmd
go test ./test/e2e
go test ./...

Notes: the first go test ./... run hit a randomized test/e2e chaos convergence failure with seed 1777627023688004000; go test ./test/e2e passed on rerun and the final go test ./... passed.

Smoke Tests

./td changelog --from v0.44.0 --to HEAD

## Unreleased

### Features
- Impersonation tokens for "view as user" (4332bd2)
- Allow admin to view as self (1eb38e7)
- Add per-project project.db pool with init+migration (td-ac453c) (63013e2)
...

### Bug Fixes
- Default nil JSON values to '\' for TEXT DEFAULT '\' columns (e176a03)
- Anchor td/td-sync/test rsync excludes to repo root (b409be2)
- Allow delegated close after approval (16c2b4d)

### Documentation
- Document clean-worktree deploy guidance (95f81ad)
- Add orchestrator review-closure policy plan (72978fa)

### Improvements
- Extract HandlerContext for read handlers (td-dda603) (88d9ed7)

./td changelog --version v0.0.0 --date 2026-05-01

## v0.0.0 - 2026-05-01

### Features
- Impersonation tokens for "view as user" (4332bd2)
...

### Bug Fixes
- Allow delegated close after approval (16c2b4d)

---

Automated by nightshift

[marcus]

Closing. This was the surviving representative of a duplicate cluster opened by an automated agent; the idea isn't being pursued from these branches. If it's wanted later, it should be rebuilt against current main.