ci(changelog): dedup bullets, strip internal ticket refs, idempotent insert

[jedigalt]

What

Three mechanical improvements to the release-notes generator (scripts/changelog-from-release.mjs) that changelog-sync.yml runs on every platform-release dispatch. These cut the manual cleanup the biweekly release-notes ticket currently absorbs by hand, without touching editorial voice (the AI-rewrite approach in #787 was deliberately closed — voice stays a human pass).

1. Collapse duplicate bullets

release-please emits one bullet per commit, so a change that lands via PR + backmerge + cherry-pick shows up 2–3 times. The generator now keeps the first and drops identical repeats (ignoring commit/PR trailer, **scope:** prefix, ticket ref, case, whitespace when comparing).

2. Strip internal ticket refs

Linear/JIRA-style refs ((TH-7938), TH-7897, (ABC-123)) that ride along in commit subjects are removed before they reach the public page. Per TH-7827: internal tracking refs are not user-facing.

3. Idempotent insert

insert() now no-ops if the version section already exists, so a redelivered or retried repository_dispatch can't double-insert.

Live proof — regenerating the current v1.38.2 release body:

Before (raw): 4 bullets — the dashboards change 3×, two carrying (TH-7938).
After: 2 clean bullets, zero TH- refs.

Also

• CI now runs the generator's test suite. pr-checks.yml gained a changelog-transform-test job — previously the tests existed but nothing ran them, so a regression in the release-notes generator could ship silently.
• Drift guard test: fails if a visible release-please section is ever left unmapped (the "silently dropped from the page" footgun the code comments already warned about).

Test

node --test scripts/changelog-from-release.test.mjs — 9/9 pass (4 pre-existing + 5 new). Node built-ins only; no new deps.