v0.4.9

Added

• The changelog reaches the people running DevGrail. This file was the only place a release was described in human terms, and it never left the repo: publish.sh opened it twice — once to take the version from the newest heading, once to stamp today's date onto it — and read no further. The registry has carried a notes field for every release since releases existed, served in the manifest and rendered on both the dashboard and the public release page, and nothing had ever written to it. So a customer whose /healthz said v0.4.8 could learn that v0.4.9 existed and could not learn what was in it, and /registry/releases was a column of version numbers and badges. Publishing now sends the section body, /registry/releases/vX.Y.Z renders it as markdown, and Settings → About links to it as "What's new in vX.Y.Z" — a release_notes_url the server had been computing and no screen had ever shown. A heading with nothing under it is now refused before anything is built, because shipping a version nobody can find out about is the failure this is meant to prevent.

  scripts/publish.sh --sync-notes re-sends every section to the release of the same name, which is how the ten releases published before this one got their notes. It builds and uploads nothing, skips versions the registry does not have rather than inventing them, and is also the way to fix a typo in prose after a release has shipped: it goes through a new PATCH that touches one column, where re-posting the release would replace the artifact set and move the pointers customers are downloading from. The dashboard grows an editor on the same path.

Fixed

• publish.sh read ### Added as a release named #. The heading regex accepted ## followed by no space, so every subsection heading in this file produced a phantom entry in the version list. Only the first line was ever used, which is why it stayed invisible — but a changelog whose first ### came before its first ## would have taken # as the version to publish.