release: concurrent auto-changelog runs drop merged entries

[taliesin-ai]

Evidence

Three Auto Changelog (v3) runs in the 2026-08-16 release window generated valid entries, committed them locally, and then failed because another workflow had advanced master:

• run 31934992275 for fix(application): let registered accelerators win over the webview on… #5902
• run 31943508534 for docs(v3): fix broken sidebar links causing 404s #5937
• run 31945940348 for Add secure Wails project MCP server #5896

Each failed with a non-fast-forward master -> master (fetch first) rejection. The workflow does not retry/rebase or otherwise preserve the generated entry. All three PRs merged before the nightly beta.9 release, but their entries are absent from the published beta.9 notes and committed beta.9 changelog.

Duplicate issue/PR searches for auto-changelog push races, non-fast-forward rejection, retry, and rebase found no existing tracker.

Impact

Concurrent merges can silently drop user-facing release notes even though the source PR merged successfully. A subsequent nightly release can publish incomplete notes with a green release workflow.

Acceptance criteria

• Auto-changelog updates tolerate another master push between checkout and publication without force-pushing.
• A rejected push is retried from current master with the generated entry preserved or regenerated.
• Concurrent runs cannot overwrite or omit each other's entries.
• Tests cover a non-fast-forward race and verify both entries land exactly once.
• Missing beta.9 entries for fix(application): let registered accelerators win over the webview on… #5902, docs(v3): fix broken sidebar links causing 404s #5937, and Add secure Wails project MCP server #5896 are reconciled in the committed changelog and public release notes by an authorized maintainer.
• The release workflow cannot report complete evidence when required changelog entries were lost.