fix(github-releaser): accept no-op manifest bumps in release-commit file-set gate

[bborbe]

Problem

The github-releaser runs the same file-set gate at two layers on the release commit — the pre-push guard guardCommittedFiles (steps_execution.go) and the AI-review check checkUnexpectedFileChange (steps_ai_review.go) — both via a shared sameStringSet requiring exact set-equality with {CHANGELOG.md} ∪ detected_manifests.

When a plugin manifest already holds the target version (byte-identical rewrite — e.g. a feature PR pre-set it), the manifest produces no diff and is absent from the commit. Both layers then reject the otherwise-valid release: the guard hard-fails with unexpected_diff, and ai_review routes it to human_review.

Live incident: bborbe/agent v0.71.0 stalled because PR #26 pre-set plugin.json to 0.71.0 (released manually as v0.71.0/581c766; this PR fixes the root cause so it doesn't recur).

Fix

• New shared helper isSubsetIncludingChangelog(committed, allowed): committed ⊆ allowed AND CHANGELOG.md ∈ committed.
• Both call sites adopt it (execution guard + ai_review). Relaxing only one would leave the release stalling at human_review.
• sameStringSet removed (no remaining caller); SameStringSetForTest → IsSubsetIncludingChangelogForTest. diffStringSet retained.
• Closed-trust-surface preserved: any file outside {CHANGELOG.md} ∪ detected_manifests still hard-fails unexpected_diff, and a commit missing CHANGELOG.md still fails.

Tests

• Execution step: no-op accepted, mixed bumped+no-op accepted, out-of-set rejected, missing-CHANGELOG rejected.
• AI-review step: no-op commit → UnexpectedFileChange=false, not in FailedChecks.
• isSubsetIncludingChangelog DescribeTable covers the asymmetric semantics.
• make precommit green (golangci-lint 0, gosec/osv/trivy clean, all specs pass).

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "The fix correctly replaces the symmetric `sameStringSet` equality check with the asymmetric `isSubsetIncludingChangelog` subset check across both the execution guard and AI-review call sites. The new helper enforces committed ⊆ allowed AND CHANGELOG.md present, correctly allowing no-op manifest commits (manifest was already at target version → absent from commit) while preserving fail-closed rejection of any file outside {CHANGELOG.md} ∪ detected_manifests. Four execution test cases and one AI-review test case cover the no-op, mixed, out-of-set, and missing-changelog paths. No issues found.",
  "comments": [],
  "concerns_addressed": [
    "correctness: isSubsetIncludingChangelog implemented in steps_execution.go:660-174 — checks committed ⊆ allowed AND CHANGELOG.md in committed; both call sites (guardCommittedFiles and checkUnexpectedFileChange) updated to use new helper",
    "correctness: both layers (execution + ai_review) now use identical relaxed rule via shared isSubsetIncludingChangelog; the no-op manifest path works correctly",
    "correctness: SameStringSetForTest replaced with IsSubsetIncludingChangelogForTest in export_test.go; sameStringSet fully removed — no remaining callers anywhere",
    "correctness: trust surface preserved — out-of-set files (README.md) still hard-fail with unexpected_diff; commits missing CHANGELOG.md still fail closed"
  ]
}