ci(changelog): let towncrier own fragment names and the release section

[datlechin]

Why

• check-changelog.py and notes.py each parsed fragment names by hand, though towncrier's strict build already refuses a bad one.
• notes.py assemble spliced the lead and [CRITICAL] into CHANGELOG.md after towncrier, and checked the prep branch only on the maintainer's machine.

Change

• towncrier checks fragment names; check-changelog.py checks fragment content and which pull request a fragment is named for.
• The lead and [CRITICAL] are typed into the release PR's CHANGELOG.md section, and Repo Hygiene checks the lead rules.
• check-changelog.py --pr reads the merge commit's diff, needs no token, and refuses a release PR that changes anything besides CHANGELOG.md and changelog.d/.

Verified

• test_check_changelog.py and test_notes.py pass; towncrier's draft of today's 70 fragments is byte-identical.
• Deleted or changed because they pinned removed behavior:
  • check-changelog: TypesTests, FetchTests (now MergeCommitTests), RepositoryTests.test_a_config_with_no_types_fails, FragmentTests.test_a_bad_name_is_refused, FragmentTests.test_counters_and_orphans_pass and PullRequestTests.test_a_fragment_named_for_the_pull_request_passes (.2 to .1), test_the_pull_request_that_creates_the_directory_moves_the_old_entries, test_editing_or_renaming_another_pull_requests_fragment_passes (rename case dropped), test_renaming_changelog_away_counts_as_editing_it, test_a_file_that_is_not_a_fragment_is_refused.
  • notes: LeadFileTests, SectionTests.test_a_fence_neither_ends_the_section_nor_starts_a_subsection, WhatsNewTests.test_no_lead_writes_a_pointer, AssembleRefusalTests (line and lead cases), TowncrierTests.test_assemble_writes_the_section_and_consumes_the_fragments, TowncrierTests.test_assemble_after_a_revert_of_an_unpublished_stable.

Not in this PR

• The rename hint for a changelog.d file with no type is fixed in ci(changelog): suggest <type>.md when an added file has no type #3521.