fix(ci): guard changelog printf bullet formats

Use printf -- for post-merge changelog bullet lines so runner shells do not treat leading hyphens in format strings as options.

Record the failed PR #13 workflow run and local reproduction proof in the US-025 story evidence.

Author: hoangbangnguyen

.github/workflows/post-merge-maintenance.yml

@@ -75,16 +75,16 @@ jobs:
           entry="$(mktemp)"
           {
             printf '## %s - PR #%s\n\n' "$date_utc" "$PR_NUMBER"
-            printf '- %s (@%s)\n' "$pr_title" "$pr_author"
+            printf -- '- %s (@%s)\n' "$pr_title" "$pr_author"
             if [ -n "$merge_sha" ]; then
-              printf '- Merge commit: `%s`\n' "$merge_sha"
+              printf -- '- Merge commit: `%s`\n' "$merge_sha"
             fi
             if [ "$cli_changed" = true ]; then
-              printf '- Harness CLI release: `%s`\n' "$release_tag"
+              printf -- '- Harness CLI release: `%s`\n' "$release_tag"
             else
-              printf '- Harness CLI release: not required\n'
+              printf -- '- Harness CLI release: not required\n'
             fi
-            printf '- Changed files:\n'
+            printf -- '- Changed files:\n'
             sed 's/^/  - `/' <<<"$changed_files" | sed 's/$/`/'
             printf '\n'
           } > "$entry"

docs/stories/US-025-post-merge-cli-release-and-changelog.md

@@ -64,3 +64,8 @@ conditional CLI release preparation after merged pull requests.
 - `cargo clippy --workspace -- -D warnings`: passed.
 - `bash -n scripts/install-harness.sh && bash -n scripts/build-harness-cli-release.sh`: passed.
 - `actionlint`: not installed locally, so GitHub-specific workflow linting was not run.
+- 2026-06-09 follow-up: GitHub run `27180707313` failed in
+  `Update maintenance files` because changelog bullet `printf` formats began
+  with `-` and were parsed as options on the runner. The workflow now uses
+  `printf --` for all bullet formats. Local reproduction of the PR #13
+  changelog entry passed.