tools/changelog-site: a compiled binary is committed to the repository

tools/changelog-site/changelog-site is a checked-in ELF executable.

$ git ls-files -s tools/changelog-site/changelog-site
100755 25adb8ea304a237d1822041791aafefe0408f4e6 0	tools/changelog-site/changelog-site
$ git cat-file -s 25adb8ea304a237d1822041791aafefe0408f4e6
4275095

4,275,095 bytes, mode 100755, ELF 64-bit LSB executable, x86-64. It sits next to main.go and go.mod, so it looks like go build output committed by accident rather than a deliberate artifact.

Two consequences:

• Running go build in that directory rewrites the tracked file, so anyone working on the tool gets a spurious 4 MB modification in git status. That is how this surfaced, while adding tools/ci/check-go-tools in #1224.
• Every clone carries the binary, and every rebuild of it adds another 4 MB blob to history.

Suggested fix

git rm --cached tools/changelog-site/changelog-site
printf "# Build output from `go build` in this directory.\n/changelog-site\n" > tools/changelog-site/.gitignore

tools/ci-health/.gitignore already does exactly this for the same reason, so the pattern is established.

Worth confirming first that nothing invokes the committed binary directly rather than go run -C tools/changelog-site .; a grep found no such caller, but the tool owner would know.

Not fixed in #1224 because it is unrelated to that change.

References

#1224

Start in tools/changelog-site with main.go, go.mod, the tracked changelog-site binary, and its .gitignore. Confirm no caller invokes the committed executable directly, then remove the binary from tracking and ignore go build output, following tools/ci-health/.gitignore. Done means rebuilding the tool no longer changes git status and the binary is absent from the repository.