feat: update changelog (#131)

closes #130 

- CHANGELOG.md file for people who can view changelog from github
---
`iris changelog` command:
`iris changelog [version]` (e.g. iris changelog v0.5.1)
`iris changelog -n 3` (see changelog of 3 latest releaseas)

=> `iris changelog` looks just like CHANGELOG.md, grouped headers and
all. It only stops looking that way if we personally overwrite that
release's description with something else
=> With 1-hour local cache (invalidated on updater-channel change),
`--refresh` flag to bypass, graceful fallback to stale cache on GitHub
rate-limiting

---
- New auto update config
```toml
# 0 = off (default, notify only), 1 = auto-install, 2 = always confirm first
auto-update = 1
```

- New just debug-changelog and just debug-autoupdate recipes (fully
offline, mocked HTTP servers, no real network/config touched)

.github/workflows/nightly.yml

@@ -33,8 +33,10 @@ jobs:
           IFS='.' read -r major minor patch <<< "$VERSION_NUM"
           patch=$((patch + 1))
           NEXT_BASE="v${major}.${minor}.${patch}"
-          SHORT=$(git rev-parse --short HEAD)
+          SHORT=$(git rev-parse --short=6 HEAD)
           echo "version=${NEXT_BASE}-nightly.${SHORT}" >> $GITHUB_OUTPUT
+          echo "short_sha=${SHORT}" >> $GITHUB_OUTPUT
+          echo "subject=$(git log -1 --format=%s)" >> $GITHUB_OUTPUT
 
       - name: Build Binaries
         run: |
@@ -71,12 +73,18 @@ jobs:
         with:
           tag_name: ${{ steps.version.outputs.version }}
           name: ${{ steps.version.outputs.version }}
+          # shaped like GoReleaser's changelog groups so `iris changelog` renders it
           body: |
             # 🌙 **Nightly build** - `${{ steps.version.outputs.version }}`
-            Nightly release from commit: ${{ github.sha }}
 
-            # Update: 
-            `iris update`
+            ### Nightly
+
+            * ${{ steps.version.outputs.short_sha }}  ${{ steps.version.outputs.subject }}
+
+            ## Update
+            ```bash
+            iris update
+            ```
 
             > install manually, this build will **not** trigger an update notification
           files: dist/*.tar.gz

.github/workflows/release.yml

@@ -62,3 +62,30 @@ jobs:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   AUR_KEY: ${{ secrets.AUR_KEY }}
                   HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+
+            # nightly tags also match refs/tags/v*, so they're excluded below
+            - name: Generate CHANGELOG.md
+              if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-nightly.')
+              uses: orhun/git-cliff-action@v4
+              with:
+                  config: cliff.toml
+                  args: --tag ${{ github.ref_name }} --output /tmp/CHANGELOG.md
+
+            - name: Commit CHANGELOG.md
+              if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-nightly.')
+              run: |
+                  # avoids a fast-forward race against the tag's detached HEAD
+                  git fetch origin main
+                  git checkout -B main origin/main
+                  cp /tmp/CHANGELOG.md CHANGELOG.md
+
+                  git config user.name "github-actions[bot]"
+                  git config user.email "github-actions[bot]@users.noreply.github.com"
+                  git add CHANGELOG.md
+                  if git diff --cached --quiet; then
+                      echo "CHANGELOG.md unchanged, nothing to commit"
+                  else
+                      # [skip ci] avoids retriggering nightly.yml for a docs-only push
+                      git commit -m "docs(changelog): update for ${GITHUB_REF_NAME} [skip ci]"
+                      git push origin main
+                  fi