feat: auto-strip candidate changes block from CHANGELOG on PR merge

[hdamker]

What type of PR is this?

enhancement/feature

What this PR does / why we need it:

Auto-removes the <!-- AUTOGENERATED:CANDIDATE_CHANGES --> block from the CHANGELOG when the Release Review PR is merged into the snapshot branch. This prevents working-area content (candidate change listings, instruction text, HTML comment markers) from leaking into draft releases.

Changes:

• Stripping logic in the reusable workflow (handle-pr-merge job): detects markers in fetched CHANGELOG, strips the block (or orphan markers), commits the cleaned file back to the snapshot branch using the App token
• Template wording (release_section.mustache): updated from "must be removed before merge" to "auto-removed on merge" with explicit editing permission
• PR checklist (release_review_pr.mustache): replaced "remove candidate changes block" with the codeowner's actual job — "all relevant changes copied into Added/Changed/Fixed/Removed"
• Bot comment (draft_created.md): conditional confirmation line when block was stripped
• BotContext: added candidate_block_stripped field

Edge cases handled:

• No markers (codeowner removed them) → no-op, no commit
• Both markers present → strip entire block, commit cleaned file
• Orphan marker (only one present) → strip just the marker line, commit

Which issue(s) this PR fixes:

Special notes for reviewers:

Tested end-to-end on hdamker/TestRepo-QoD (PR #99):

• Created snapshot → verified CHANGELOG has candidate changes block with updated wording
• Merged Release Review PR without removing the block
• Verified: commit on snapshot branch strips the block
• Verified: draft release body is clean (no markers, no "Working area" text)
• Verified: draft_created bot comment includes "Release notes cleaned (candidate block removed)."
• Verified: no spurious workflow re-trigger

Re-trigger safety: the commit to release-snapshot/* does not match the caller workflow's push trigger (filtered to branches: [main] + paths: [release-plan.yaml]).

Changelog input

 release-note
feat: auto-strip candidate changes block from CHANGELOG when Release Review PR is merged

Additional documentation

docs
n/a