GeezerVison

Summary

Removes the changelog-rollover job from the release workflow. After publishing, that job committed a chore(changelog): roll [Unreleased] over to vX.Y.Z change directly back to main. Branch protection rejects that push every time:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Required workflow 'Audit GHA Workflows' is not satisfied
remote: - Changes must be made through a pull request.
remote: - Commits must have verified signatures.
! [remote rejected] HEAD -> main (push declined due to repository rule violations)

So the job failed every release while adding no value.

Changes

• Delete the changelog-rollover job and scripts/rollover-changelog.sh.
• Simplify the version job's CHANGELOG check to require an explicit ## [X.Y.Z] heading. It previously also accepted a non-empty ## [Unreleased] section as a stand-in for the post-publish stamp the rollover job would write — that path no longer exists.

New flow

Maintainers rename ## [Unreleased] → ## [X.Y.Z] — DATE by hand in the version-bump PR (the same PR that bumps Cargo.toml). No post-release push to main, so nothing fights branch protection.

🤖 Generated with Claude Code