ci: avoid generated-notes API in immutable release workflow #455

The v0.5.0 publication workflow run 38012473061 built, validated, published to PyPI, and attested both artifacts, but its final GitHub Release step failed when gh release create used --generate-notes and received HTTP 404 from the generated-notes API. The release was recovered manually with explicit --notes and is now public. Remove --generate-notes from the immutable release workflow and add a regression test asserting explicit release notes are retained, so future publication runs do not depend on the failing generated-notes path.