CHANGELOG truth: extractor must fail on duplicate headings; add heading-tag-version gate; reconcile 0.11-0.24 #176

Three connected defects:

1. scripts/extract-changelog-section.ts uses first-indexOf heading match while ## [0.4.0], ## [0.3.0], ## [0.2.0] each appear twice — release notes are correct only by accident of ordering. Count matches and throw on >1, with a test over the real CHANGELOG.
2. No gate relates headings, git tags, and package.json version: tags stop at v0.10.0 (= last npm publish for liteship/create-liteship; @liteship/* scopes never published), 0.14-0.17 carry dates with no tag, 0.20-0.24 are all "(unreleased)", and 0.18/0.19 have no blocks despite README/ARCHITECTURE dating the Effect shed and rename to them.
3. Root cause of the version inflation: the api-surface gate correctly demands a bump per public-surface change, but no release was ever cut after 0.10.0 — 14 unreleased minors piled up. First publish of 0.24.0 closes the gap; the gate then keeps the ledger honest.