ci(release): unify generated release notes

[tulayha]

Summary

• use the existing dependencies and skip-changelog PR labels as changelog-fragment exemptions
• render prerelease and stable GitHub release bodies from Towncrier
• keep Semantic Release as the sole version/tag authority and consume fragments only during stable releases
• align contributor and release guidance with the automated behavior

Why

Towncrier owned CHANGELOG.md while Semantic Release independently generated GitHub release bodies, so the two could diverge. The Dependabot exemption also relied on the workflow trigger actor rather than durable PR metadata.

Validation

• actionlint
• bash -n utils/build_package.sh
• parsed pyproject.toml with tomllib
• ruff check src tests
• completed a prerelease-mode package build without consuming fragments
• completed a stable-mode package build in an isolated worktree
• verified the rendered release body exactly matches the section inserted into CHANGELOG.md
• verified stable mode consumes the pending fragment