ci(release): include GitHub contributor attribution

[tulayha]

Related issue

Maintainer-requested release contributor attribution; no linked issue.

Summary

Published beta and stable GitHub releases now include GitHub-generated PR author credits and its optional New Contributors section in an expandable section below the existing product changelog. Release Please continues to own versioning and changelog selection. This is internal release automation with visible release-page attribution; no application API, storage, or index migration changes.

The candidate records the previous tag from the appropriate channel manifest at the release PR's base commit, before the version bump. Publication verifies that tag and uses the explicit range with GitHub's generate-notes endpoint. .github/release.yml excludes the release bot while retaining human contributions. Rendering retries replace the attribution block without duplicating it or losing the product changelog.

GitHub supplies PR-based attribution, not comprehensive reviewer or coauthor accounting. A first contribution can appear in both beta and stable notes. Note generation failures stop the GitHub publication step; package/container publication may already have completed. Nightly releases are unchanged. Existing candidate artifacts without previous_tag must be regenerated.

Validation

Repeated after applying to fresh main:

• PYTHONPATH=src /Users/grayhat/Developer/vidxp/.venv/bin/python -m pytest -q tests/test_release_notes.py — 6 passed, covering preservation/replacement on retries, notes without newcomers, and empty-note rejection.
• /Users/grayhat/Developer/vidxp/.venv/bin/ruff check utils/render_release_notes.py tests/test_release_notes.py — passed.
• /private/tmp/vidxp-ci-actionlint/actionlint -shellcheck= -pyflakes= .github/workflows/release-candidate.yml .github/workflows/release-to-pypi.yml — passed using Actionlint 1.7.12; optional ShellCheck/Pyflakes integrations disabled.
• /opt/homebrew/bin/git diff --check — passed.

During local implementation, exercised the tag-selection shell against a temporary real Git repository: beta/stable manifest selection, pre-bump base selection despite a bumped head, and missing-tag rejection passed. Previewed real GitHub generate-notes responses without publishing a release.

No application builds, full Python suite, or live release publication were run. Markdownlint and Lychee were not run locally; documentation validation is left to CI.