…partial release

Replace the validate job's exact-SHA ancestry check (git merge-base
--is-ancestor MAIN_COMMIT) with branch-consistency.sh --check: release branches
are built by cherry-picking, so commits exist under different SHAs and the SHA
check could never pass. --check matches by PR number, the correct measure.

Add resume=true: when a run created the tags but never published the Release,
re-run with the same inkless_version to skip tagging and re-run build+publish
(discovers branches/Kafka versions from the existing tags).

…dentation

The release notes were built as a YAML block-scalar heredoc, so the
leading indentation leaked into the markdown and rendered headings and
bullets as an indented code block. Build the notes in a temp file with
printf and pass --notes-file instead.

The curated-changelog injection is split out to land with the
inkless-changelog skill (the generator it calls lives there).

Clarify the prep->release seams in RELEASES.md: push branches is the prep gate;
tags are created by the workflow (never by hand); resume=true finishes a
partially-completed release; and a corrected break-glass build/publish procedure
using the make targets with the right image tag format (<kafka>-<increment>-<arch>).

The changelog-generation docs are split out to land with the inkless-changelog
skill (the generator they reference lives there).

Add gen-changelog.py + the inkless-changelog skill: diff conventional-commit
history and configs.rst/metrics.rst between two inkless-release tags to produce a
detailed CHANGELOG.md entry and a curated release-notes summary. Detects upstream
syncs (apache/kafka merges + gradle version delta) and notes them.

Backfill docs/inkless/CHANGELOG.md for increments 0.33..0.44 and link it from the
docs index.

…otes

The finalize-release job now runs gen-changelog.py --summary against the freshly
created inkless-release-<N> tag and appends the curated feat/fix/config summary to
the Release body (best-effort: falls back to boilerplate notes if generation fails).
Requires fetch-depth: 0 so the generator can diff the previous tag.

Also documents the changelog/release-notes flow in RELEASES.md. Depends on the
inkless-changelog generator added in the previous commit; stacks on the release
workflow (#714) which owns inkless-publish.yml.

…tooling

Add the inkless-release-prep and inkless-upstream-sync agent skills and refresh
the inkless-sync docs/prompts. Enhance the cherry-pick flow:

- branch-consistency.sh --check: exit non-zero only on actionable-missing commits
  (matched by PR number; old below-window commits do not count), for CI gates.
- cherry-pick-to-release.sh: stop on first conflict (never auto-abort-and-continue,
  which reordered picks); restore version-owned files (gradle.properties/Makefile/
  .env) to the branch value after every pick so version bumps land without changing
  the branch version; --dry-run reports version-owned handling and no longer
  requires a clean worktree.

Branch-specific divergences are handled in history (cherry-pick + sync(revert):/
sync(align):), documented in the skill and README -- no skip-list side file.