Lint changelog placement in PRs (new entries under Unreleased)

[dragonstyle]

What

A small self-contained CI check that runs only when a PR modifies CHANGELOG.md, and verifies new entries land under the ## Unreleased section.

Passes:

• Additions inside ## Unreleased — including creating the header (the first entry after a release)
• Edits to already-released entries (hunks that also delete lines), so typo fixes in old sections are fine
• Release-prep changes that rename ## Unreleased to a version header — releases aren't blocked

Fails, with line-level annotations in the diff view:

• New entries added under an already-released version header (the common slip right after a release, when ## Unreleased was just consumed)
• New entries when no ## Unreleased section exists (fix: add one at the top)

Why

The changelog is hand-curated and high-traffic; misplaced entries surface as missing release notes and get caught late (or not at all). This makes placement mistakes visible at PR time instead.

Notes

• Single workflow file; Python stdlib only, no external actions beyond checkout. permissions: contents: read.
• The placement logic is tested against six scenarios (add-in-unreleased, add-under-released, typo-fix-in-released, release-prep rename, post-release header creation, no-header-add) — happy to share the harness.
• Draft for your review — no repo settings are needed for it to run; making it a required check would be a separate (admin) decision, and it's useful without that.

🤖 Generated with Claude Code