Release flow can silently miss changelog entries merged after the release PR is created

## Problem

The current release flow uses a manually-triggered `workflow_dispatch` on `create-release-pr.yml`. When triggered, it runs `changie batch` to collect all entries in `.changes/unreleased/` at that moment and opens a release PR.

If any PRs that include changie entries are merged to `main` **after** the workflow is triggered but **before** the release PR is merged, those entries are silently left behind in `.changes/unreleased/`. The code ships in the release but the changelog entry does not — there is no warning, no CI failure, nothing.

## Example

1. `create-release-pr` workflow is triggered on day N — `changie batch` runs and creates the release PR
2. A feature PR is merged on day N+1 — it adds a changie entry to `unreleased/` on `main`
3. The release PR is merged on day N+1 a few hours later
4. Result: the feature is in the release, but its changelog entry is orphaned in `unreleased/` and missing from the published changelog

## Suggested Fix

A few possible approaches:

1. **Re-run `changie batch` on the release branch before merging** — add a step (or a required check) that detects whether `unreleased/` on `main` contains entries not present in the current release batch, and fails/updates accordingly.

2. **Auto-update the release PR when new entries land on `main`** — trigger a workflow on push to `main` that, if a release branch already exists, re-runs `changie batch` and amends the release PR.

3. **Enforce PR ordering** — block the release PR merge via a required check that compares `.changes/unreleased/` on `main` against what was batched, surfacing any gap.

Any of these would prevent changelog entries from being silently dropped between the time the release PR is created and when it is merged.