Add a changelog and enable Github releases

[nikgraf]

Closes #185

Why

The changelog generated by changeset version was silently discarded, so there is no CHANGELOG.md anywhere, none in the npm tarballs, and zero Github releases despite 15 published versions:

1. changeset version writes build/ristretto/CHANGELOG.md and build/p256/CHANGELOG.md, but .gitignore has /build/*/** with only !/build/*/package.json un-ignored — the changelogs were never committed.
2. bin/build.js starts with sh.rm("-rf", "build"), so even a locally generated changelog was destroyed before changeset publish ran.
3. That also explains the missing Github releases. changesets/action defaults create-github-releases: true, but its createRelease() reads <pkg.dir>/CHANGELOG.md and returns silently on ENOENT — no changelog file, no release, no error.

Changesets is the right tool here, its output was just being thrown away. No workflow change is needed for the releases to start appearing.

What changed

• .gitignore — un-ignore /build/*/CHANGELOG.md.
• bin/build.js — read both changelogs at module scope (before the rm -rf build) and restore them afterwards, mirroring how build/ristretto/package.json is already handled. Also adds CHANGELOG.md to the generated files array so it ships to npm.
• bin/sync-changelog.js (new) — mirrors the ristretto changelog to a root CHANGELOG.md. Wired into the changeset-version script so it lands in the Version Packages PR.
• .changeset/config.json — switched to @changesets/changelog-github for PR links, commit links and author attribution, and marked the two packages as fixed. The fixed entry matters because bin/build.js interpolates ristretto's version into both generated package.json files; without it a changeset touching only one package would silently diverge.
• Backfilled the changelog for all released versions. Entries from 0.8.1 onwards are the original changeset texts, recovered from git (they survive as deletions in each Version Packages commit), with PR/commit links and author credit added. 0.1.0–0.8.0 predates changesets and is reconstructed from the git history, marked as such in the file.
• Docs — CONTRIBUTING.md gains a Changelog section, and its version link now points at bump-version.yml instead of release.yml.
• Dropped the duplicated pnpm install step in both release workflows.

Verification

• pnpm build no longer destroys the changelogs, and npm pack --dry-run in build/ristretto now lists CHANGELOG.md.
• Dry-ran pnpm changeset-version with a real token: both packages bumped to 1.1.1 in lockstep, the pending changeset rendered with its PR link and author credit, the root mirror updated and the backfilled history preserved below it. State was restored afterwards.
• pnpm format, prettier --check . and pnpm test (47 tests against both curves) pass.

Follow-up, not in this PR

Cargo.toml is at 1.0.0 while npm is at 1.1.0 — the Rust version is bumped manually and has drifted. The crate is not published to crates.io so it is cosmetic today.