ci-local.sh proves the workflows parse; drop stray CHANGELOG heading

[RichardHightower]

Why

#82 was an unparseable ci.yml. GitHub failed the run at startup with zero jobs, so test and okf-interop did not execute for a week while pull requests still looked green. Only worklog.yml reported, which is why nobody noticed.

The fix for #82 shipped in v0.9.5. This adds the guard that makes the same class of defect fail loudly. A workflow that cannot start cannot check itself, so the check has to run before the push. tools/ci-local.sh already states that it runs everything the workflows run.

What

One step, placed first because a broken workflow means nothing else reaches CI:

== workflows ==
  ok    workflows parse

It yaml.safe_loads every .github/workflows/*.yml and fails when the glob finds none, so deleting the workflows cannot make it pass vacuously. Written as a single-line python3 -c, which is the style the repo settled on after #82.

Also removes the second ## Unreleased heading in CHANGELOG.md. It dated from the 0.7.2 era and sat between the 0.7.3 and 0.7.2 sections. Its two bullets describe host manifests reaching 0.7.2, which shipped in 0.7.3, so they fold into the 0.7.3 list above. The intentional placeholder at the top is untouched.

No assertion changed and no released behavior changed.

Verification

Negative test, the part that matters. Reinjecting the exact #82 shape, a multi-line python3 -c at column 1 inside a run: | block, makes the new step fail:

== workflows ==
  FAIL  workflows parse
              if self.check_token(KeyToken):

With the workflow restored, tools/ci-local.sh reports 26 passed, 1 failed.

The one failure is pre-existing and not from this branch. test_titleless_stem_match_is_invisible_on_every_engine fails the same way on clean main: on macOS /var is a symlink to /private/var, so relative_to() raises. Linux CI has no such symlink, so it passes there. Worth a separate item.

🤖 Generated with Claude Code