fix: correct the release skill's TEAM_ID guard and publish order

[jvsena42]

Summary

Fixes issues found by actually running /release v0.2.0 end to end. One of them was a real bug that would have aborted every future release.

The TEAM_ID guard in step 4 told the release to check that git diff "shows nothing else" besides the version lines. Taken literally that greps the whole diff, which includes unchanged context lines — and TEAM_ID= sits three lines above the version block in Config.xcconfig, so it matched on every run and aborted the release. It has to inspect added lines only.

The publish order was also wrong: the tag was pushed at step 8 and the changelog only approved at step 9, so the notes were reviewed after the tag was already public.

Changes

• TEAM_ID guard: inspect added lines only (git diff | grep -E "^\+[^+]"), with a note explaining why grepping the full diff false-positives, so it does not regress.
• Changelog before tag: steps reordered into a single confirm-then-publish gate. The previous-tag lookup changes from HEAD~1 to HEAD accordingly, since the new tag does not exist yet at that point.
• gh release create specifics: use --notes-file rather than --notes for multi-line bodies, pass --latest explicitly, and verify via the releases/latest endpoint — gh release view --json isLatest is not a valid field and errored during the run.
• Do not chain git commands: added to the Important section. Chaining commit && push && gh pr create is what left a commit pushed with no PR when the call was declined mid-run; also records that git rev-parse @{u} can fail on a branch that was pushed when its remote-tracking ref is simply unfetched.
• Changelog guidance: group by commit type first and summarize thematically (the v0.2.0 range was 91 commits), and do not trust subjects blindly — two fix: update changelog commits only touched .gitignore.

Test plan

Guard verified in both directions against the real v0.2.0 bump commit (ecbdb36):

• Old guard replayed on that diff → aborts (reproduces the false positive).
• New guard on the same diff → passes, showing exactly the four version lines.
• Negative test: simulated a locally filled TEAM_ID alongside a version bump → new guard aborts, so real leaks are still caught. The test file was restored afterwards (TEAM_ID empty, versions 2 / 0.2.0).
• Skill scanned for leaked values: only bare constant names, no paths, no TEAM_ID value.

Documentation-only change — no build or app behaviour is affected.

Checklist

• ./gradlew detekt passes
• Tested on Android
• Tested on iOS
• Updated documentation (if applicable)

_{detekt unaffected (no Kotlin touched) but passing as of the last run; device boxes left unchecked as this changes only the release skill.}