fix(ci): generate changelog from release tag, not from main - #2530

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/agents/changelog.md`:
- Around line 502-512: The "Identify new contributors" pass currently scans the
changelog with an unfiltered `@username` regex and can include bot/CI accounts;
reuse the same bot-filter pipeline used for the Contributors list (the grep -oE/
sed -E/ grep -viE pipeline shown and specifically the bot-exclusion regex
'^(app/|.*\[bot\]$|cozystack-ci$|github-actions$|dependabot$|renovate$)') when
detecting first-time contributors so the same accounts are excluded; update the
new-contributors extraction to pipe through the same sed/grep -viE filter (or
call the same helper/command) so bots are never reported as "New Contributors."

---

Nitpick comments:
In @.github/workflows/tags.yaml:
- Around line 334-335: The prompt passed to the changelog generator currently
mentions "HEAD" which reintroduces ambiguity; update the --prompt string used in
the workflow so it uses v${VERSION} explicitly as the upper bound (remove any
reference to HEAD or "HEAD ==") and ensure the text still instructs following
docs/agents/changelog.md and producing docs/changelogs/v${VERSION}.md; locate
the --prompt invocation in the tags.yaml workflow and replace the clause "The
repository is checked out at the v${VERSION} tag commit, so HEAD == the release
commit. Use v${VERSION} (or HEAD) as the upper bound..." with wording that only
references v${VERSION} as the upper bound.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/agents/changelog.md`:
- Around line 529-533: The pipeline building /tmp/all_previous_contributors.txt
currently greps across docs/changelogs/v*.md and therefore includes the current
release file; update the pipeline that builds the contributors list to
explicitly exclude the current release file (the docs/changelogs/v<version>.md
for this run) before extracting usernames — e.g., after listing
docs/changelogs/v*.md, filter out the current release filename (use grep -v
"$CURRENT_RELEASE_FILE" or remove basename via sed) so that the subsequent
grep/sed/sort -u that writes /tmp/all_previous_contributors.txt does not contain
contributors from the file being released; ensure the same exclusion is applied
where comm -23 is used to detect first-time contributors.
- Around line 106-107: Documentation and the tags workflow disagree about
whether to allow HEAD for comparing releases: update the
.github/workflows/tags.yaml workflow prompt (the usage of "v${VERSION} (or
HEAD)") to match the docs' strict guidance of using the release tag only (e.g.,
"v${VERSION}") so Copilot/CI will never default to HEAD; locate the prompt text
in tags.yaml and replace the ambiguous "or HEAD" phrasing with explicit
instructions to only use the release tag (v${VERSION}) and add a short
clarifying comment if needed to mirror the language in docs/agents/changelog.md.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/tags.yaml:
- Line 334: The CI prompt in .github/workflows/tags.yaml (the --prompt string
that references docs/agents/changelog.md) conflicts with the changelog doc's
Step 2 requiring branch "main" while this job runs detached at tag v${VERSION};
update that prompt to include an explicit CI override that states the workflow
is running on a detached tag and must NOT attempt to switch branches or require
main, and instruct the agent to use the checked-out tag v${VERSION} as the
single source-of-truth/upper bound for comparisons; edit the prompt string (the
--prompt value) to clearly say "CI_OVERRIDE: running on detached tag
v${VERSION}; do not switch branches or require main; use v${VERSION} as upper
bound" so the agent follows the doc's formatting rules but skips branch
validation.
- Around line 289-299: The "Checkout release tag" step (actions/checkout@v4 with
ref: ${{ steps.tag.outputs.tag }}) causes the subsequent check_changelog step to
run against the immutable tag tree so it cannot detect a changelog already
merged on origin/main; change the flow so check_changelog runs against the
branch state on origin/main (either by moving the tag checkout after
check_changelog, or by checking out origin/main (or running git fetch origin
main and pointing check_changelog at origin/main) before invoking
check_changelog), and keep the later "Create changelog branch" step branching
from origin/main as intended.

In `@docs/agents/changelog.md`:
- Around line 106-107: Step 6 still uses HEAD for the release window
(RELEASE_END=$(git log -1 --format=%ai HEAD)), which contradicts the "never use
HEAD" rule; update both Step 6 snippets to compute RELEASE_END from the release
tag variable (the tag you already pass/compute for the release, e.g.,
RELEASE_TAG or RELEASE) instead of HEAD so the end of the release window is
based on the explicit tag (use the tag variable in the git command that sets
RELEASE_END).