Fail a tag whose annotation lost its headings

git tag -a -F and -m apply git's default message cleanup, which deletes every line starting with #, so a CHANGELOG section used as a tag annotation loses its ## [x.y.z] and ### headings. The tag pipeline publishes that annotation as the Release notes, which is how v0.4.0 shipped without them.

CONTRIBUTING.md now gives the exact release command with --cleanup=verbatim and says why. A new tag-only tag-notes-check job, which runs before the release stage, fails the tag when its annotation lacks the ## [X.Y.Z] heading for the tag or any ### heading, and a lightweight tag fails it too.

The behavioral suite builds a throwaway repo and checks that a default-cleanup tag fails the check and a verbatim tag passes. just ci is green.