(fix): accept generated notes on the draft release

[abnegate]

Fixes run 32446810818, which tagged 2.0.1, drafted the release, then died on Draft release 374170913 is unsafe.

The defect

GitHub::createDraft asks GitHub for generated notes:

['-F', 'generate_release_notes=true'],

so the release GitHub returns has the automation's body plus the generated changelog appended. Both draft checks then compared that body for equality against what was sent:

|| $release->body !== $body// GitHub::assertDraft
|| $draft->body !== $body// Orchestrator::validateDraft

That comparison can never hold while notes are generated, so the release step could not succeed on any run. It is not a flake — every dependency release would have died at exactly this point, after the tag and the draft already existed, leaving the half-finished state recovery then has to unpick.

The rejected draft is intact and correct — tag_name: 2.0.1, target_commitish: 8a93696, draft: true, markers present. Only the equality check was wrong.

Why a prefix check, not dropping the generated notes

Dropping generate_release_notes would also fix it, but the generated changelog is what previous releases shipped and is worth keeping. The property the safety check actually depends on is that the automation's markers — dependency-automation:v1, dependency-target:<sha>, dependency-pull:<n> — are present and unaltered at the head of the body. str_starts_with asserts exactly that, and everything else in the check (tag, target, pull, draft, prerelease) is unchanged.

RecoverySelector::matches already reads the markers rather than demanding an exact body, so this makes the two paths consistent.

Diagnosability

Draft release <id> is unsafe named none of the six fields it compared, which is why a guaranteed failure needed the API response and the source side by side to explain. Both sites now list which fields mismatched.

Verification

• test_accepts_a_draft_with_generated_notes_appended reproduces the production failure: a draft whose body is the automation body plus a ## What's Changed block. Confirmed it errors with is unsafe against the old equality check and passes with the fix.
• test_rejects_a_draft_whose_markers_were_rewritten keeps the safety property honest — a draft carrying a different dependency-pull marker is still rejected, with the new message naming the body.
• composer verify: Pint, PHPStan max, 154 tests / 1815 assertions, 91 parity contracts.

Not verified

• No end-to-end release has run with this fix. The next dispatch is the real test, and the draft/tag left behind by the failed run has to be cleared first (see the PR discussion) or the run will find a stale 2.0.1.
• The existing tests fed the fake API the same body they sent, which is precisely why this shipped. The new test uses a body the fake does not echo back, but the fake is still a fake — only a live run exercises GitHub's actual note generation.

[greptile-apps]

Greptile Summary

This PR allows GitHub-generated release notes to follow the automation-owned draft body while retaining exact validation of release metadata and marker content.

• Replaces exact body equality with full-prefix validation in both draft safety checks.
• Expands unsafe-draft errors to identify every mismatched field.
• Adds regression coverage for generated-note suffixes and rewritten markers.
• Documents the release failure and diagnostic improvements in CHANGES.md.

Confidence Score: 5/5

The PR appears safe to merge, with the intended suffix relaxation bounded by independent release metadata and marker validation.

The expected automation body must still match exactly at the beginning of the draft, all release state fields remain checked, and final publication additionally validates marker uniqueness and merge correspondence.

Important Files Changed

Filename	Overview
.github/scripts/src/Automation/Orchestrator.php	Accepts appended release notes during final draft validation while preserving tag and recovery-marker checks and reporting individual mismatches.
.github/scripts/src/Automation/Repository/GitHub.php	Validates the complete expected body as a prefix of GitHub's returned draft and retains exact checks for tag, target, pull, draft, and prerelease state.
.github/scripts/tests/Unit/Automation/OrchestratorTest.php	Adds focused regression tests proving generated notes are accepted while rewritten automation markers remain rejected.
CHANGES.md	Records the generated-release-notes incompatibility and improved mismatch diagnostics.

_{Reviews (1): Last reviewed commit: "(fix): accept generated notes on the dra..." | Re-trigger Greptile}