fix: stamp release notes at release time, so users actually see them

[ThorSPB]

The problem

changelog.py deliberately ignores non-version headings, so anything sitting
under ## Unreleased is invisible to users — no error, it simply never
appears. Notes get written under that heading as work lands, and nothing ever
moved them out.

v1.6.1 shipped with both its notes still under ## Unreleased and showed its
users no release notes at all. You said you never move them by hand, so the
release has to do it.

The fix

scripts/stamp_changelog.py renames ## Unreleased → ## v<version> in both
language files:

• idempotent — a re-run must not stamp twice, which would swallow the next
  version's notes into an already-released section
• leaves an empty Unreleased alone — a release with no user-visible change
  must not ship a bare heading
• refuses a non-x.y.z version; exit 1 means "nothing to stamp", a normal
  outcome that must not fail the release

release.yml runs it in create-release before the tag is cut and commits
the result, so the notes actually leave ## Unreleased rather than being
re-shipped verbatim under the next version too. That commit carries a skip-CI marker,
or the push to main would start a second Release run.

All four build jobs now check out the tag rather than the triggering commit.
This is the subtle half: the stamp only exists on the tag, so without it every
build would package the pre-stamp changelog and the fix would do nothing
visible. They are already gated on a non-empty version, and the tag exists by
then on both trigger paths (push + bump tag, and a direct tag push).

Also corrects the history the missing stamp left behind

The icon fix did ship in v1.6.1, so it now sits under that heading. The
Made-for-Kids note stays under ## Unreleased, because it only actually works
once #33's solver-script fix lands. So a user going 1.6.1 → 1.6.2 sees exactly
the one note that is new to them, and a user on 1.6.0 sees both.

Tests

308 passed. Five new tests cover the rename, idempotency, the empty section, a
bad version, and the point of the whole exercise — that notes_since() returns
nothing before stamping and returns the note after. Idempotency and the
empty-section guard were both mutation-checked.

Note

The first push of this branch got no CI at all: my commit message quoted the
skip-CI token verbatim while explaining it, and GitHub honours that token
anywhere in the message. A squash merge would have carried it onto main too.
Scrubbed from both the message and this body, and CLAUDE.md now warns about it.

No bump tag in this title, so merging it cuts no release on its own.