release: an unpublished version in CHANGELOG breaks the next release and the Publish notes step #657

The 0.65.0 and 0.65.1 releases each failed at a different point after the release commit reached main, and each left the repo unable to cut the next release until a hand fix.

• 0.65.0: the merge-commit CI failed on a flaky test (fixed in test(observability): scope the no-log assertion to the scrape route #651). release.ts stops with "do not tag", correctly, but main already carries chore(release): 0.65.0, the CHANGELOG has a ## [0.65.0] section, and the [Unreleased] compare link points at v0.65.0, a tag that does not exist.
• Because of that link, the next run failed before doing anything: git log v0.65.0..HEAD (collectCommits, commit-detail.ts:105). Fixed by hand in docs(changelog): point the Unreleased compare link at v0.64.0 #653.
• 0.65.1: tagged, then Publish failed at "Build the release notes" with tag v0.65.0 is not in this clone, because release-notes.ts takes the previous version from the next heading down. v0.65.1 is on origin and cannot be moved (ruleset), so the recovery was 0.65.2.

What done looks like:

1. release.ts and release-notes.ts resolve the previous version from the newest tag that exists (git describe --tags --abbrev=0 --match "v*"), not from the CHANGELOG link or heading. An unpublished version heading then cannot break the next release.
2. release.ts --push runs the release-notes step in dry-run mode before it tags, so the failure shows up while the tag can still be avoided.
3. A regression test covers a changelog whose newest heading has no tag.

Evidence: runs 43016837766 (flaky test) and 43022603341 (notes step). Not urgent: 0.65.2 shipped and npm latest is 0.65.2.