ci: auto-release on version bump + PR changelog guard

[just-be-dev]

Two basic things here:

1. Once a change lands on main that's bumped the package version it should do a release
2. Enforce changelog updates in PRs that touch the package version.

AI Summary

Merging a PR that bumps the Cargo.toml version didn't cut a release, because release.yml only fired on a pushed v* tag. This wires releases to the package version and adds a guard so version bumps stay in sync with the changelog.

Release: auto-cut on version bump (release.yml)

• Now also triggers on pushes to main (still supports v* tag pushes and workflow_dispatch).
• New gate job reads version from Cargo.toml, computes v<version>, and:
  • if that tag is missing → creates/pushes it and sets should_release=true;
  • if it already exists → should_release=false (no-op).
• build / release / crates now needs: gate and run only when should_release == 'true', using needs.gate.outputs.tag instead of github.ref_name.

Everything happens in one workflow run, which sidesteps the GitHub rule that a tag pushed with the default GITHUB_TOKEN won't trigger a separate workflow — so no PAT is required.

Note: this is "tag-if-missing", not "tag-on-diff" — so once merged, the first main push will catch up the currently-missing v0.2.0 release.

CI: PR-only changelog guard (ci.yml)

• New changelog job gated on pull_request events (never runs on main, so it can't block the release flow).
• If a PR bumps the Cargo.toml version, it must add a matching ## [<version>] section to CHANGELOG.md, or the check fails with an annotation. PRs that don't touch the version pass untouched.

Requirements

• CARGO_REGISTRY_TOKEN secret (already used by the crates job).
• Actions allowed to push tags (contents: write, already requested by gate).