[Backport to release 1.3] fix(ci): generate changelog from release tag, not from main - #2574

The generate-changelog job in .github/workflows/tags.yaml previously
checked out main and ran the AI agent there. The agent followed
docs/agents/changelog.md, which instructed it to compute the release
range with `git log <previous_version>..HEAD`. For minor releases
(vX.Y.0) cut from main this happens to give the right answer; for
patch releases (vX.Y.Z, Z>0) cut from a release-X.Y branch, HEAD-on-
main is a strict superset of the release tag and contains commits
that were merged to main both before and after the tag.

The v1.3.1 changelog generated by this workflow (#2480) demonstrated
the failure mode: it included 8 PRs merged to main but never shipped
in v1.3.1, 6 backport PRs that landed on release-1.3 *after* v1.3.1
was tagged, both originals and their backports as separate entries,
a hallucinated 2024 PR, and the cozystack-ci bot in the contributors
list. The corrected v1.3.1 changelog contains the single fix that
v1.3.1 actually ships.

This PR fixes the root cause and tightens the agent guardrails:

* tags.yaml: check out the release tag commit (`ref: ${{ steps.tag.
  outputs.tag }}`) instead of `main`, so HEAD == the release commit
  and `git log v<prev>..HEAD` corresponds to the actual release. The
  Create-changelog-branch step still creates the PR branch from
  origin/main, so PRs continue to merge cleanly into main.
* tags.yaml: update the AI prompt to state explicitly that HEAD is
  the release commit and that the upper bound for the release range
  is the new tag, not main.
* docs/agents/changelog.md: replace `..HEAD` with `..v<new_version>`
  in every example so the instruction is unambiguous regardless of
  which branch is checked out.
* docs/agents/changelog.md: add a hard rule that backport PRs MUST
  be merged into the original entry (single line, two PR numbers),
  never listed as a second entry. Document the edge case where the
  original PR is outside the range — drop the entry.
* docs/agents/changelog.md: forbid using the brief description
  verbatim as the detailed description, and forbid inventing entries
  for PRs that are not in the release range.
* docs/agents/changelog.md: filter bot/CI accounts (`app/*`,
  `*[bot]`, cozystack-ci, github-actions, dependabot, renovate) out
  of the human Contributors list. Bot attribution on individual
  entries is still valid.

The corresponding correction for the v1.3.1 changelog itself is in
PR #2480 on the changelog-v1.3.1 branch.

Signed-off-by: Myasnikov Daniil <[email protected]>
(cherry picked from commit 2420d89)