feat: update changelog (#131)

closes #130 

- CHANGELOG.md file for people who can view changelog from github
---
`iris changelog` command:
`iris changelog [version]` (e.g. iris changelog v0.5.1)
`iris changelog -n 3` (see changelog of 3 latest releaseas)

=> `iris changelog` looks just like CHANGELOG.md, grouped headers and
all. It only stops looking that way if we personally overwrite that
release's description with something else
=> With 1-hour local cache (invalidated on updater-channel change),
`--refresh` flag to bypass, graceful fallback to stale cache on GitHub
rate-limiting

---
- New auto update config
```toml
# 0 = off (default, notify only), 1 = auto-install, 2 = always confirm first
auto-update = 1
```

- New just debug-changelog and just debug-autoupdate recipes (fully
offline, mocked HTTP servers, no real network/config touched)

.github/workflows/release.yml

@@ -62,3 +62,30 @@ jobs:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   AUR_KEY: ${{ secrets.AUR_KEY }}
                   HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
+
+            # nightly tags also match refs/tags/v*, so they're excluded below
+            - name: Generate CHANGELOG.md
+              if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-nightly.')
+              uses: orhun/git-cliff-action@v4
+              with:
+                  config: cliff.toml
+                  args: --tag ${{ github.ref_name }} --output /tmp/CHANGELOG.md
+
+            - name: Commit CHANGELOG.md
+              if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-nightly.')
+              run: |
+                  # avoids a fast-forward race against the tag's detached HEAD
+                  git fetch origin main
+                  git checkout -B main origin/main
+                  cp /tmp/CHANGELOG.md CHANGELOG.md
+
+                  git config user.name "github-actions[bot]"
+                  git config user.email "github-actions[bot]@users.noreply.github.com"
+                  git add CHANGELOG.md
+                  if git diff --cached --quiet; then
+                      echo "CHANGELOG.md unchanged, nothing to commit"
+                  else
+                      # [skip ci] avoids retriggering nightly.yml for a docs-only push
+                      git commit -m "docs(changelog): update for ${GITHUB_REF_NAME} [skip ci]"
+                      git push origin main
+                  fi