fix(release): drop test-at-tag from release.yml — ci.yml is the gate

The release job ran `npm run check` and `npm test` on a bare runner
with no `age` installed — ci.yml apt-installs it because the secrets
tests round-trip a real age identity, so the first real tag push would
have died at `npm test` and minted no release. The job now does exactly
what the flow (cast#96 / box#83) assigns it: `npm ci && npm run build
&& npm prune --omit=dev`, tar, `gh release create` — check and tests
already gated the merge commit the tag points at.

Also aligns CHANGELOG.md with the family preamble ("History before
0.1.0 lives in git") and with the workflow's actual build steps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -45,16 +45,16 @@ jobs:
         run: bash scripts/changelog-section.sh "$GITHUB_REF_NAME" CHANGELOG.md > /tmp/release-notes.md
 
       - name: build the package, once
+        # Just the build — check and tests already gated the merge commit
+        # this tag points at (ci.yml, with its age dependency); the release
+        # job's whole job is packaging that green tree.
         run: |
           npm ci
-          npm run check
           npm run build
-          npm test
 
       - name: assemble cast-${{ github.ref_name }}.tgz
         # The runnable tree and nothing else: bin/, dist/, production
-        # node_modules/, package.json. Pruned AFTER the tests so what ships
-        # is the tree that passed. Top-level dir named like a GitHub
+        # node_modules/, package.json. Top-level dir named like a GitHub
         # archive's, so the installer handles both shapes identically.
         run: |
           npm prune --omit=dev

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-History before versioning lives in git. Feature PRs land their entry in
+History before 0.1.0 lives in git. Feature PRs land their entry in
 `## Unreleased` as part of the PR; a release PR stamps that section with
 the version and date (see cast#96 — the release flow shared with
 heavy-duty/box#83).
@@ -14,7 +14,7 @@ heavy-duty/box#83).
   `package.json` (the single source of truth — no separate `VERSION` file)
   plus the install root. On a bare `X.Y.Z` tag push, `release.yml` asserts
   the tag matches `package.json`, builds once in CI (`npm ci`, `npm run
-  build`, `npm test`, `npm prune --omit=dev`), tars the runnable tree into
+  build`, `npm prune --omit=dev`), tars the runnable tree into
   `cast-X.Y.Z.tgz`, and creates the GitHub release with that version's
   changelog section as the body and the tarball attached. The installer now
   defaults to the **latest release asset** — resolved via the