fix: pin checkout to default branch, use notes-file, anchor CHANGELOG grep

- Add ref: master/main to actions/checkout in all prepare/publish workflows
  so workflows always operate on the default branch regardless of dispatch ref
- Replace shell-injection-prone ${{ steps...outputs.notes }} pattern with
  --notes-file using $RUNNER_TEMP/release-notes.md (safe from backticks/quotes
  in changelog content)
- Treat empty [Unreleased] section as a hard error in prepare-release
- Fix CHANGELOG verification grep: grep -qE "^## \[VERSION\]" (anchored,
  prevents substring matches and prefix collisions like 3.1.0 vs 3.1.0-rc1)

Author: joaodordio

.github/workflows/prepare-release.yml

@@ -22,6 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          ref: master
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Validate version format
@@ -50,6 +51,8 @@ jobs:
           } > "$temp_file"
           mv "$temp_file" "$changelog_file"
 
+          echo "See CHANGELOG.md for release notes." > "$RUNNER_TEMP/release-notes.md"
+
       - name: Bump package.json version
         run: npm --no-git-tag-version --allow-same-version version "${{ github.event.inputs.version }}"
 
@@ -88,5 +91,5 @@ jobs:
             gh release create "$version" \
               --draft \
               --title "$version" \
-              --notes "See CHANGELOG.md for release notes."
+              --notes-file "$RUNNER_TEMP/release-notes.md"
           fi

.github/workflows/publish-release.yml

@@ -21,10 +21,12 @@ jobs:
     environment: npm
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: master
 
       - name: Verify release is ready
         run: |
-          if ! grep -qF "## $VERSION" CHANGELOG.md; then
+          if ! grep -qE "^## $VERSION\b" CHANGELOG.md; then
             echo "::error::CHANGELOG.md has no entry for $VERSION. Merge the prepare-release PR to master before running this workflow."
             exit 1
           fi