Add GitHub release notes config and deprecate CHANGELOG.md

[dennisdoomen]

Switches release notes from the manually maintained CHANGELOG.md to GitHub's automatic release notes feature.

What changed

• Added .github/release.yml to configure automatic GitHub release notes, with categories matching the repo's label conventions (�reaking-change, enhancement, �ug, security, dependencies, documentation, internal/process/
  efactor/chore). Dependabot PRs and PRs labelled skip-changelog or dependencies are excluded.
• Marked CHANGELOG.md as deprecated with a notice pointing to .github/release.yml and the GitHub Releases page.
• Added rule Add CodeQL workflow for security scanning #7 to AGENTS.md explicitly banning conventional-commit prefixes on commit messages and PR titles.
• Added matching guidance to CONTRIBUTING.md under the PR-writing section.

Related to #263

[ChrisonSimtian]

awesome, looking forward to that one :-)

[dennisdoomen]

@ChrisonSimtian something I only realized now. We're currently creating/generating release notes on GitHub for everything on experimental. I'm arguing that that isn't necessary, as the experimental stuff will still end up on main eventually. Isn't it better that you skip the tag/release notes and just push the packages to the GitHub package feed? That would make the preview code available for those that care without polluting the release notes on GH.

[ChrisonSimtian]

Isn't it better that you skip the tag/release notes and just push the packages to the GitHub package feed?

agreed

[dennisdoomen]

Then this one only needs an approval