fix(release): check-versions validates the generated TUI changelog slice, not byte equality

The packaged changelog is now a recent-releases slice produced by
scripts/sync-changelog.sh (which gains a --check mode); also restore the
SECURITY.md contact line the version gate guards, and finish the stale
binary-name sweep (--bin codewhale examples, qa harness doc).

scripts/release/check-versions.sh

@@ -61,10 +61,10 @@ if [[ -n "${internal_dep_drift}" ]]; then
   fail=1
 fi
 
-# 4) Packaged TUI changelog copy.
-if ! cmp -s CHANGELOG.md crates/tui/CHANGELOG.md; then
-  echo "::error::crates/tui/CHANGELOG.md must match root CHANGELOG.md for crates.io packaging." >&2
-  echo "Run: cp CHANGELOG.md crates/tui/CHANGELOG.md" >&2
+# 4) Packaged TUI changelog slice (recent releases embedded in the binary).
+if ! ./scripts/sync-changelog.sh --check >/dev/null 2>&1; then
+  echo "::error::crates/tui/CHANGELOG.md is out of date with the root CHANGELOG.md slice." >&2
+  echo "Run: ./scripts/sync-changelog.sh" >&2
   fail=1
 fi
 

scripts/sync-changelog.sh

@@ -3,19 +3,39 @@
 # The /change command embeds this file into the binary via include_str!, so
 # it deliberately keeps only the most recent release sections.
 #
-# Usage: scripts/sync-changelog.sh [sections-to-keep]   (default: 15)
+# Usage: scripts/sync-changelog.sh [--check] [sections-to-keep]
+#   --check  verify crates/tui/CHANGELOG.md is up to date without writing
+#            (exit 1 if regeneration would change it)
+#   sections-to-keep defaults to 15
 set -eu
+CHECK=0
+if [ "${1:-}" = "--check" ]; then
+  CHECK=1
+  shift
+fi
 KEEP="${1:-15}"
 root="$(cd "$(dirname "$0")/.." && pwd)"
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
 awk -v keep="$KEEP" '
   /^\[/ && /\]: http/ { exit }
   /^## \[/ { count++ }
   count > keep { exit }
   { print }
-' "$root/CHANGELOG.md" > "$root/crates/tui/CHANGELOG.md"
+' "$root/CHANGELOG.md" > "$tmp"
 printf '%s\n' \
   '---' \
   '' \
   'Older releases: [CHANGELOG.md](https://github.com/Hmbown/CodeWhale/blob/main/CHANGELOG.md) and [docs/CHANGELOG_ARCHIVE.md](https://github.com/Hmbown/CodeWhale/blob/main/docs/CHANGELOG_ARCHIVE.md).' \
-  >> "$root/crates/tui/CHANGELOG.md"
-echo "wrote crates/tui/CHANGELOG.md ($(wc -l < "$root/crates/tui/CHANGELOG.md") lines, $KEEP sections kept)"
+  >> "$tmp"
+if [ "$CHECK" = 1 ]; then
+  if cmp -s "$tmp" "$root/crates/tui/CHANGELOG.md"; then
+    echo "crates/tui/CHANGELOG.md is up to date"
+  else
+    echo "crates/tui/CHANGELOG.md is out of date; run scripts/sync-changelog.sh" >&2
+    exit 1
+  fi
+else
+  cp "$tmp" "$root/crates/tui/CHANGELOG.md"
+  echo "wrote crates/tui/CHANGELOG.md ($(wc -l < "$root/crates/tui/CHANGELOG.md") lines, $KEEP sections kept)"
+fi