feat(docs): tag builds, feed the changelog to machines, fail maintenance when it ages

Tasks 3, 4, 5, 6, 7 of the changelog plan.

- 67 build tags (v4.6.10 … v4.6.119) now exist, so a build is a ref instead of something that has
  to be re-inferred: `git log v4.6.118..v4.6.119` finally means something.
- The generator prefers tags, but via ONE `git for-each-ref` pass rather than a `git describe` per
  commit. That matters: describe-per-commit made the build 2.4-2.7 s against a 1.0-1.45 s baseline
  — i.e. tags made it slower, which the plan's gate said to treat as "tags bought nothing".
  The right fix was a bulk lookup, not dropping the tags: now 0.80-1.04 s (median 0.84 s) with
  output byte-identical to the untagged baseline (68 entries, same version order).
- changelog.json + feed.xml (Atom) are generated from the same page dict: 36 KB / 21 KB, 68/68
  entries, both HTTP 200, item markup stripped so a reader gets text not HTML.
- check_changelog() now also asserts the page was GENERATED recently, not merely that its version
  matches: a version match survives a dead cron forever. Seeded a 26-day-old timestamp ->
  "FAIL: changelog: generated 640h ago (>48h) - the daily job is not running", maintenance FAIL;
  restored -> "PASS: changelog age 0.1h", maintenance OK.
- The exact cron pre-script was run end to end, not a stand-in: MAINTENANCE (--fix) block prints
  "PASS: changelog: changelog current: v4.6.119 (68 entries)" and "PASS: changelog age 0.2h",
  result OK, no second cron created.
- Scale trigger written into the generator's docstring (split by year at ~150 builds), not built.
- Mobile re-checked after the page gained the deep-link note: changelog + board both
  ALL VIEWPORTS OK at 360/390 px, light and dark.

0 files changed, 0 insertions, 0 deletions