[codex] Support curated release notes files

[clifton]

Issue

release.sh always generated GitHub release notes from a flat list of commits. Release managers could not supply curated Markdown while keeping the generated commit history available for auditing.

User impact

Release notes can now lead with a task-oriented, curated summary without losing the exact commit list. Existing invocations continue to generate the same release-note template when no notes file is supplied.

Root cause

The script treated its only argument as the version bump type and constructed one fixed release-note template. It had no argument state for a notes file and no conditional rendering path.

Fix

• Accept a notes file as either the second positional argument or --notes <file>.
• Allow --notes before or after the bump type, with patch still the default.
• Validate that the notes path is a readable regular file before branch checks, pulls, version edits, commits, or tags.
• Use the curated Markdown as the start of the GitHub release body.
• Append the generated commit list inside <details><summary>Commits</summary>.
• Retain the dependency-version footer.
• Preserve the original release-note output when no notes file is provided.
• Replace non-POSIX local and read -p usage while touching the script, and stream notes with printf.

Usage

Positional notes file:

./release.sh minor RELEASE_NOTES.md

Flag form, defaulting to a patch bump:

./release.sh --notes RELEASE_NOTES.md

The flag may also precede the bump type:

./release.sh --notes RELEASE_NOTES.md major

Legacy behavior is unchanged:

./release.sh patch

Validation

• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test (including 210 unit tests, integration suites, and 75 doctests)
• sh -n release.sh
• dash -n release.sh
• Manual dry-path argument checks for help, no notes, positional notes, flag notes in both orders, default patch with --notes, missing flag value, missing file, directory path, duplicate notes, duplicate bump type, invalid bump type, and unknown option
• Verified the valid dry paths stopped at the non-main branch guard and that Cargo.toml, rstructor_derive/Cargo.toml, Cargo.lock, and release tags were unchanged

No tag, GitHub release, version bump, or crates.io publication was created during validation.