ci: auto-update CHANGELOG.md on release via git-cliff

After creating the GitHub release, regenerate the full CHANGELOG.md with
git-cliff and commit it back to master (chore(release): ... [skip ci]),
only when it actually changed. The release job now checks out master so
the commit can be pushed to the branch. Keeps the tracked changelog in
sync with each tagged release instead of drifting.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: popstas

.github/workflows/release.yml

@@ -18,6 +18,7 @@ jobs:
       - name: Check out the codebase
         uses: actions/checkout@v5
         with:
+          ref: master  # commit the regenerated CHANGELOG back to master
           fetch-depth: 0  # git-cliff needs full history
 
       - name: Generate release notes
@@ -36,6 +37,26 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Regenerate CHANGELOG.md
+        uses: orhun/git-cliff-action@v4
+        with:
+          config: cliff.toml
+        env:
+          OUTPUT: CHANGELOG.md
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Commit CHANGELOG.md to master
+        run: |
+          if git diff --quiet -- CHANGELOG.md; then
+            echo "CHANGELOG.md already up to date"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add CHANGELOG.md
+          git commit -m "chore(release): update CHANGELOG for ${{ github.ref_name }} [skip ci]"
+          git push origin HEAD:master
+
   galaxy:
     name: Import to Ansible Galaxy
     runs-on: ubuntu-latest