Release: the tag step refuses while any changelog.d fragment remains at the tagged commit (after #870) #872

What must hold: release.mjs X.Y.Z (the tag step) refuses, before building or tagging, while any changelog.d/ fragment remains at the commit being tagged. A release never ships with notes that weren't folded into its dated section.

Why: after #870, notes live in changelog.d/ until the changelog step folds them into the dated section and deletes them in the release commit. #831's tag step reads only the dated section. If a fragment lands after the release PR is cut, or the changelog step is skipped or partly applied, the tag step would tag without those notes, silently. #870 refuses a fragment added after the release PR is cut (owner decision 2026-10-20). This closes the same gap at the tag step. The owner approved it as a follow-up.

Design: in tagNotes or just before it in release.mjs, list changelog.d/*.md (except README.md) at the tagged commit through git, not the working tree. Any fragment means refuse, naming each file and the command to fold it. This only adds a refusal, so the tag step only refuses more.

Acceptance:

• A test where the tag step on a commit with one leftover fragment exits non-zero, creates no tag and names the file. Fail-without: on Release notes: one changelog.d file per change, moved into the dated section by the changelog step [PROTECTED: owner merges] #870's head it tags.
• A commit with only changelog.d/README.md tags as before.
• Released sections' tag notes are unchanged (the existing equality test).

Risk class: protected (release tooling). The owner merges. Starts after #870 merges.