fix(generate): pass built-in changelog to manage-release by file to avoid E2BIG

[joshua-temple]

Problem

The generated manage-release composite action put the full release changelog on an Actions input, which GitHub exposes as an environment variable. Linux caps a single environment variable near 128KB (MAX_ARG_STRLEN), so a changelog above that fails the execve of the step's bash with E2BIG before the program runs. A real repository hit this once its accumulated built-in changelog reached about 135KB: the Manage Release step died and every downstream job cascaded.

Window finding

The built-in changelog window is bounded by design (base is the next environment's current SHA, head is the source SHA; root-commit fallback only on a first-ever deploy). The 135KB is an inherent large-history case, not a windowing bug, so the window is preserved rather than truncated (truncating would drop legitimately new entries).

Fix

Keep the exact same content but stop routing it through an input. The Generate Changelog step now writes the markdown to $RUNNER_TEMP/cascade-changelog.md, and callers pass that path through a new changelog_file action input, which the action hands straight to the already-existing cascade manage-release --changelog-file. Only a small fixed path transits the input; the content never touches the env or argv. The changelog output is byte-identical (same cascade generate-changelog call, redirected to a file).

Why not regenerate inside manage-release from previous_tag..sha: in promote, the manage-release sha for prerelease/publish is the release environment's SHA, which differs from the changelog head (the source SHA), so regenerating from sha would change content. File reference preserves exact parity and works for both same-job (steps.X.outputs) and cross-job (needs.X.outputs) SHA references.

The custom-changelog reusable-workflow path runs on a separate runner and its output can only reach the finalize job as a cross-job workflow output, so it retains the content input as a documented residual (it cannot be file-referenced without an artifact contract).

Verification

• New unit tests prove the built-in release, promote, and orchestrate-finalize paths pass the changelog by file and no longer place content on an input (red before, green after).
• A CLI regression exercises a 200KB --changelog-file read.
• A new e2e scenario runs the file-reference path through orchestrate and publish.
• Byte-identical baseline goldens regenerated; the only change is the changelog wiring.
• go build ./..., go test ./... (3645 pass), go test ./... -race, golangci-lint run ./... all clean, plus the e2e module builds and vets clean.
• Docs updated (generated-workflows reference) and a code-quality standard added to CONTRIBUTING.md.

[github-actions]

All PR Validation checks passed.