ci: automate changelog rollover during tagged release (R591)

[ryacub]

Objective

Automate changelog finalization for tagged releases so ## Unreleased is rolled into the released version and reset after release creation.

Closes #605

Scope

• Add scripts/finalize_changelog_release.py to:
  • no-op if target release section already exists
  • move first ## Unreleased content into ## [version] - YYYY-MM-DD
  • recreate an empty ## Unreleased section template
• Update .github/workflows/build_push.yml to:
  • finalize changelog in the tag workspace before extracting release notes
  • checkout main after release and persist the same changelog rollover commit
  • skip commit when no changelog diff exists (idempotent reruns)

Verification

• ./gradlew spotlessCheck
• ./gradlew :app:compileDebugKotlin
• Script smoke/idempotency check:
  • run scripts/finalize_changelog_release.py twice on a temp changelog copy
  • confirm only one ## [<version>] section is created

Risk

T2. Changes release workflow behavior and writes back to main during tag releases. Risk mitigated by idempotent script behavior and no-op checks when version section already exists.

Rollback

Revert this PR to restore prior release behavior (no automatic changelog rollover).