Release process is too manual, CI build of release .deb changes files

Everything that can be reasonbly automated in the release process should be automated. Updating NEWS can't be automated, nor can picking a new version number, but everything else can be. If we can avoid an MR review cycle, that'd be great for speeding tthings up.

debian/changelog changes during release process, when the Debian package is built in Lars's Ick instance. The git testament output further lists extra files debian/debhelper-build-stamp and debian/subplot/ which should be added to .gitignore.