Render changelog subjects as literal text - #475

…#477)

bump:workflow rewrote every vX.Y.Z in .github/workflows to this project's new
version. Its one real target was the self-reference in release.yml, and #475
replaced that with `uses: ./` -- so the script now has no legitimate target
and only collateral damage.

Cutting a release today would rewrite

  actions/setup-node@8207627... # was: actions/setup-node@v7.0.0

to `# was: actions/setup-node@v4.9.0`, a release of setup-node that does not
exist. gh-refme maintains those comments so a reviewer can tell what upstream
release a pinned SHA corresponds to; corrupting them defeats the pinning the
README recommends. It is cosmetic to the runtime and misleading to a human,
which is the worse half.

Anchor the substitution to the self-reference. It is a no-op while the
workflows use `uses: ./`, and correct again if the pin ever returns. The test
covered the old behaviour, so it asserted the corruption; it now proves a
third-party provenance comment survives a bump.


Claude-Session: https://claude.ai/code/session_015EmepbnR2nSdk8q8DBsrsD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

actionlint flagged SC2086 on the unquoted $GITHUB_OUTPUT. Quoting it alone
would have polished a snippet that does not work.

The example percent-encodes newlines as %0A, which the removed ::set-output
command used to decode. $GITHUB_OUTPUT does not, so the step has been emitting
one line with literal %0A in it. The latest end-to-end run shows exactly that:

  %0A- [c74bcf9](...) - ` Fix README example spacing. `%0A- [8ea6bc3](...)

Use the heredoc form, which is how a multiline value is returned now. The
delimiter is random rather than fixed because the value is built from commit
subjects: a fixed marker is a string a commit subject could contain in order
to write further keys into $GITHUB_OUTPUT, which is the same class of problem
as the Markdown injection fixed in #475.

README carried the same broken snippet, so it is fixed there too, along with
the prose explaining the escaping and its dead github.community link.


Claude-Session: https://claude.ai/code/session_015EmepbnR2nSdk8q8DBsrsD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

actionlint flagged SC2086 on the unquoted $GITHUB_OUTPUT. Quoting it alone
would have polished a snippet that does not work.

The example percent-encodes newlines as %0A, which the removed ::set-output
command used to decode. $GITHUB_OUTPUT does not, so the step has been emitting
one line with literal %0A in it. The latest end-to-end run shows exactly that:

  %0A- [c74bcf9](...) - ` Fix README example spacing. `%0A- [8ea6bc3](...)

Use the heredoc form, which is how a multiline value is returned now. The
delimiter is random rather than fixed because the value is built from commit
subjects: a fixed marker is a string a commit subject could contain in order
to write further keys into $GITHUB_OUTPUT, which is the same class of problem
as the Markdown injection fixed in #475.

README carried the same broken snippet, so it is fixed there too, along with
the prose explaining the escaping and its dead github.community link.

Claude-Session: https://claude.ai/code/session_015EmepbnR2nSdk8q8DBsrsD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
(cherry picked from commit 0bee5ad)