test(release): cover workflow injection safety and prerelease note check

The AUR test pinned the literal ${{ steps.version.outputs.VERSION }}
interpolation that moved into an env block, so it failed once the tag
value started reaching the shell as $RELEASE_VERSION.

Update that assertion and add guards for the invariant behind the move:
no tag-derived value may be interpolated into a run body, where GitHub
substitutes it before the shell parses the line. Also assert the
prerelease workflow runs the committed-notes check before it creates or
edits the release.

Document that the fragment delta resolves git paths against cwd, which
is both the project root and the repository root.

scripts/build-changelog.ts

@@ -233,6 +233,11 @@ function defaultListPrereleaseTags(cwd: string, baseVersion: string): string[] {
 
 // Diffs changes/*.md between the previous prerelease tag and the working tree.
 // Renamed fragments are treated as modifications of the new path.
+//
+// Like every other path in this script, git paths are resolved against `cwd`,
+// which is the project root and also the repository root. Callers that point
+// `cwd` elsewhere already fail earlier and loudly, when package.json and
+// changes/ come back missing.
 function defaultResolveFragmentDelta(cwd: string, previousTag: string): FragmentDeltaEntry[] {
   const output = execFileSync(
     'git',