cliff.toml is the keep-a-changelog template; CHANGELOG.md is the initial baseline. release.sh now regenerates CHANGELOG.md and feeds the unreleased section to `gh release create --notes-file`, so the in-repo changelog and GitHub Release notes stay in sync.