docs(skill): condense GH release notes, link bullets to SHAs

Release skill now:
- requires each CHANGELOG bullet to end with (sha) or (sha1, sha2)
  so GH auto-linkifies to the introducing commit;
- condenses extracted notes before gh release create (one line per
  bullet, no marketing prose, sections in canonical order);
- keeps CHANGELOG long-form; only the GH release body is terse.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: dfa1

.claude/skills/release.md

@@ -44,6 +44,15 @@ The `CHANGELOG.md` file must contain a section for the release version. Two case
 
 Update the compare link at the bottom of the file from `compare/vPREV...main` to `compare/vPREV...v<releaseVersion>`. The previous version is whatever the second-most-recent `## [x.y.z]` heading shows.
 
+**Each bullet must end with the introducing commit SHA(s) in parens.** GitHub auto-links bare 7+ char SHAs in CHANGELOG.md and release bodies. Use `git log --oneline vPREV..HEAD` and grep for the relevant subjects to find each SHA. If a bullet spans multiple commits, list them comma-separated (newest first).
+
+```
+- Layout-tree depth capped at 64; metadata capped at 4 MiB. (a1b2c3d)
+- ScanResult → renamed Chunk (scan.ScanResult → scan.Chunk). (e4f5a67, b8c9d0e)
+```
+
+If a bullet's SHA can't be determined (e.g. cross-cutting work touched in many commits), use the compare-range tag: `(vPREV...v<releaseVersion>)`. Do not leave a bullet unlinked — the link is the receipt that the entry came from real work, not a hallucination.
+
 Commit the changelog edits as `docs(changelog): finalize <releaseVersion> section` before invoking `mvn release:prepare` so the release commit doesn't pick up unrelated drift.
 
 ### 3. Tag via `mvn release:prepare`
@@ -79,7 +88,7 @@ Once the tag is on origin, the deploy workflow starts. Capture the run URL for t
 
 ### 5. GitHub release
 
-Extract the version's section from `CHANGELOG.md` into a temp file, then create the release. The `awk` block stops at the next `## [` heading so the body contains exactly one version's notes:
+Extract the version's section from `CHANGELOG.md` into a temp file. The `awk` block stops at the next `## [` heading so the body contains exactly one version's notes:
 
 ```bash
 awk -v ver="<releaseVersion>" '
@@ -89,7 +98,25 @@ awk -v ver="<releaseVersion>" '
 ' CHANGELOG.md > /tmp/release-notes-<releaseVersion>.md
 ```
 
-Then:
+**Condense before publishing.** CHANGELOG entries carry full context (attack details, rationale, file refs); the GitHub release body must stay scannable — aim ~30 lines, ~one line per bullet. Rewrite the extracted file in place, applying these rules:
+
+- **First line is the headline.** One sentence stating the technical themes. No `The headline themes for this release are…`. Replace the opening paragraph with a single technical sentence.
+  - Good: `Security-hardening sweep of the parser, Array interface slimmed, cascading writer features.`
+  - Bad: `The headline themes for this release are a security-hardening sweep of the file-format parser…`
+- **Sections in this order, omit empty ones:** `Security`, `Added`, `Breaking`, `Removed`, `Performance`, `Fixed`, `Build`. Use `Breaking` (not `Changed`) for source/binary-breaking changes — readers scan for it.
+- **One line per bullet.** No sub-bullets. If a bullet needs two sentences, the detail belongs in CHANGELOG, not GH release.
+  - Good: `Layout-tree depth capped at 64; metadata capped at 4 MiB.`
+  - Bad: `Layout-tree depth cap — PostscriptParser.convertLayout is capped at depth 64, preventing both unbounded nesting and self-referential FlatBuffer cycles (a ~120-byte cycle attack previously triggered StackOverflowError).`
+- **Drop `see docs/X.md` / `documented in …` references.** Readers click compare diffs, not doc cross-refs.
+- **Drop benchmark prose.** Keep the number, drop the surrounding sentence.
+  - Good: `ALP + Dict broadcast modulo gated by cap == n check (~5–10× recovery).`
+- **Migration hints stay terse.** `old → new`, one line. e.g. `ScanResult → renamed Chunk (scan.ScanResult → scan.Chunk).`
+- **Preserve trailing commit SHAs.** Each bullet inherits `(sha)` / `(sha, sha)` from CHANGELOG; do not strip them. GitHub auto-links bare 7+ char SHAs in release bodies.
+- **Footer:** keep the compare link only: `[<version>]: https://github.com/<owner>/<repo>/compare/v<prev>...v<version>`.
+
+CHANGELOG stays long-form; do not force the two to match.
+
+Then create the release:
 
 ```bash
 gh release create v<releaseVersion> \