build(release): derive versions and notes from tags and fragments

[datlechin]

Why

Tag-driven releases need one place that turns a tag into a version, build and channel, refuses a tag that must not build, and renders notes from changelog fragments. Nothing calls these tools yet.

Change

• scripts/release/version.py: parse prints version, build ((MAJOR*1000+MINOR)*100+PATCH)*100+R, channel and line. check runs the tag rules and the CI walk, and diffs a borrowed verdict with the change detector.
• scripts/release/notes.py: assemble, body, feed, lead, critical, whats-new and docs, crediting outside PR authors.
• towncrier.toml, and scripts/release/requirements.txt pinning towncrier 26.9.0 with hashes.
• Repo Hygiene runs scripts/release/test_*.py on Python 3.9 in a venv installed with pip --require-hashes.

Verified

The tests pass on Python 3.9 with towncrier installed from the hashed file. Every CHANGELOG.md section rendered by notes.py docs compiles with @mdx-js/mdx.

Not in this PR

• check reads release-build.yml and the release detector suite, which the Release Build PR adds.
• The changelog marker, changelog.d/, the fragments and .venv/ in .gitignore land at the cutover.