feat(release): gate that Settings 'What's New' modal stays in sync with CHANGELOG

The What's New modal (AccountInfoSection.vue) hardcodes one block per release
and had silently drifted: it sat at v1.7.84 while the fleet shipped through
v1.7.92, so eight releases of notes never reached users in Settings.

- scripts/sync-whats-new.py: renders a modal block from each CHANGELOG version
  that's missing one (curated bullets, dev-process 'Validation…' lines dropped),
  inserts newest-first; never touches older hand-written pre-CHANGELOG history.
  --check mode lists anything missing and exits non-zero.
- tests/release/run.sh: new 'whats-new-sync' static gate runs --check, so a
  release with an un-surfaced CHANGELOG entry fails before shipping.
- Backfilled the eight missing blocks (v1.7.85 … v1.7.92) into the modal.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/release/run.sh

@@ -63,6 +63,11 @@ summary() {
 stage "git-diff-check"   git diff --check
 stage "cargo-fmt"        timeout 240 cargo fmt --manifest-path core/Cargo.toml --all --check
 stage "catalog-drift"    python3 scripts/check-app-catalog-drift.py
+# Every release must surface its CHANGELOG entry in the Settings "What's New"
+# modal. The modal hardcodes a block per version and has drifted behind before
+# (sat at v1.7.84 while the fleet shipped to v1.7.92). Fail if any CHANGELOG
+# version is missing a block; `python3 scripts/sync-whats-new.py` inserts them.
+stage "whats-new-sync"   python3 scripts/sync-whats-new.py --check
 if [[ $MANIFEST -eq 1 ]]; then
   stage "release-manifest" scripts/check-release-manifest.sh
 fi