ci: add CI with OpenCode e2e, weekly latest-OpenCode e2e, release workflow, and Dependabot

- ci.yml: unit tests on Node 22, 24, 26 plus the end-to-end check against OpenCode 1.18.31 + 2.0.32 and 1.19.3 + 2.1.0
- e2e-latest.yml: weekly end-to-end run against the newest opencode-ai and @opencode/cli releases
- release.yml: tag vX.Y.Z reruns CI and publishes with npm trusted publishing
- Jobs run on GitHub only; the Gitea origin's runner skips them
- Dependabot proposes grouped npm and Actions updates weekly

.github/scripts/changelog-section.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// Prints the CHANGELOG.md section for a version (used as GitHub Release notes).
+// Fails when the section is missing or still marked "Unreleased", so a release cannot ship undated notes.
+import { readFileSync } from "node:fs";
+
+const version = process.argv[2];
+if (!version) {
+    console.error("Usage: changelog-section.mjs <version>");
+    process.exit(2);
+}
+
+const lines = readFileSync(new URL("../../CHANGELOG.md", import.meta.url), "utf8").split("\n");
+const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const start = lines.findIndex((line) => new RegExp(`^## ${escaped}(\\s|$)`).test(line));
+
+if (start === -1) {
+    console.error(`CHANGELOG.md has no "## ${version}" section.`);
+    process.exit(1);
+}
+if (/unreleased/i.test(lines[start] ?? "")) {
+    console.error(`CHANGELOG.md section "${lines[start]}" is still marked Unreleased; replace it with the release date.`);
+    process.exit(1);
+}
+
+const end = lines.findIndex((line, index) => index > start && line.startsWith("## "));
+const body = lines.slice(start + 1, end === -1 ? undefined : end).join("\n").trim();
+process.stdout.write(`${body}\n`);