Make changelog assembly recoverable after a partial write

`--write` wrote CHANGELOG.md and then removed fragments one by one, so a
failure after the write left surviving fragments that a rerun spliced in
a second time.

The write is now staged. The assembled file goes into
changelog.d/.assembling/, the fragments are renamed in beside it, and
renaming the assembled file over CHANGELOG.md is the single commit
point. A run that fails rolls itself back when it can; otherwise the next
`npm run changelog` reads the staging directory and either restores the
fragments (assembled file still staged) or deletes the leftovers (batch
landed). `--check` reports a staged batch instead of reporting past it.

A failure-injection test makes every filesystem call in a `--write` fail
in turn, both as a one-off error and as a crash with no in-process
rollback. It asserts the retry produces exactly the uninterrupted
CHANGELOG.md, with each entry once and an empty directory. The test
fails against the previous write-then-delete and against delete-first.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/MAINTAINER_WORKFLOW.md

@@ -130,7 +130,9 @@ resolves the top of `CHANGELOG.md`. At release, `npm run changelog:check` previe
 the batch and its order; `npm run changelog` splices it into `CHANGELOG.md` and
 empties the directory. The assembler refuses a malformed filename or two fragments
 claiming one PR number before writing, and copies text through unchanged so the
-contributor's wording and credit ship.
+contributor's wording and credit ship. The write is staged in
+`changelog.d/.assembling/`, so if it fails part-way, rerunning `npm run changelog`
+finishes or rolls back the batch. It never duplicates or drops an entry.
 
 Return this concise record privately unless posting is authorized. Keep sensitive
 security evidence in the private report: