release: cut v0.2.0-beta CHANGELOG section + inject into release body

.github/workflows/release.yml

@@ -178,8 +178,42 @@ jobs:
           name: sbom
           path: ./release-assets
 
+      # Extract the section for this tag from CHANGELOG.md so it shows
+      # up at the top of the GitHub Release body. `generate_release_notes`
+      # below still appends the auto-generated "What's Changed" PR list
+      # afterwards — best of both: hand-curated narrative + complete
+      # commit/PR audit trail. The awk picks the block between
+      # "## [<version>]" and the next "## [".
+      - name: Extract CHANGELOG section for this release
+        id: changelog
+        run: |
+          set -euo pipefail
+          TAG_RAW="${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}"
+          VERSION="${TAG_RAW#v}"
+          echo "Extracting CHANGELOG section for version: ${VERSION}"
+          # Substring-based extraction (no regex escapes — different awk
+          # builds disagree on whether `\[` is literal or a metachar).
+          # `index($0, marker) == 1` is true iff the line starts with the
+          # exact marker string, which is what we want.
+          awk -v marker="## [${VERSION}]" '
+            index($0, marker) == 1 { p=1; next }
+            p && index($0, "## [") == 1 { exit }
+            p && $0 != "---" { print }
+          ' CHANGELOG.md > release-body.md
+          if [[ ! -s release-body.md ]]; then
+            echo "::warning::CHANGELOG.md has no section for [${VERSION}] — falling back to auto-generated notes only"
+          else
+            echo "--- release-body.md preview (first 40 lines) ---"
+            head -40 release-body.md
+            echo "--- (truncated) ---"
+          fi
+
       - uses: softprops/action-gh-release@v3
         with:
+          body_path: release-body.md
+          # `body_path` gets *prepended* to the auto-generated PR list
+          # when both are set, so we end up with a curated header + the
+          # full commit audit trail underneath.
           generate_release_notes: true
           draft: false
           prerelease: ${{ contains(github.ref, '-') }}