ci: add git-cliff changelog generation

Generates CHANGELOG.md from conventional commits on main and
release/* branches. Runs in parallel with docker build after
tests pass. Commits back with [skip ci] to avoid loops.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -141,3 +141,37 @@ jobs:
         run: |
           docker push registry.meghsakha.com/certifai/dashboard:${{ steps.tag.outputs.tag }}
           docker push registry.meghsakha.com/certifai/dashboard:latest
+
+  # ---------------------------------------------------------------------------
+  # Stage 3b: Generate changelog from conventional commits
+  #           Only on main and release/* branches
+  # ---------------------------------------------------------------------------
+  changelog:
+    name: Changelog
+    runs-on: docker
+    needs: [test]
+    if: >-
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
+    container:
+      image: rust:1.89-bookworm
+    steps:
+      - name: Checkout (full history)
+        run: |
+          git clone "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" .
+          git checkout "${GITHUB_SHA}"
+      - name: Install git-cliff
+        run: cargo install git-cliff --locked
+      - name: Generate changelog
+        run: git cliff --output CHANGELOG.md
+      - name: Commit and push changelog
+        run: |
+          git config user.name "CI Bot"
+          git config user.email "ci@certifai.local"
+          git add CHANGELOG.md
+          if git diff --cached --quiet; then
+            echo "No changelog changes to commit"
+          else
+            git commit -m "docs: update CHANGELOG.md [skip ci]"
+            git push origin HEAD:"${GITHUB_REF_NAME}"
+          fi