feat(sdk): add release notes and align Anthropic client behavior

[moonyue-w]

Summary

GitHub Releases now publish reviewed notes from the matching CHANGELOG.md version. Forward and Managed clients also align timeout scope, ordinary response request IDs, and manual pagination with the pinned Anthropic TypeScript SDK (sdk-v0.127.0).

• Add changelog validation/extraction, CI coverage, release-workflow integration, and contributor/PR guidance.
• Keep the default 10-minute timeout around each underlying fetch only. Clear it when a response arrives; credential resolution, middleware, and response-body/SSE reads are outside that timer. Caller AbortSignal cancellation still covers the operation and stream reads.
• Expose a typed, non-enumerable _request_id on ordinary JSON object responses. Prefer QCA's x-request-id, fall back to request-id, and use null when neither is present. Preserve withResponse().request_id and the shapes of arrays, page objects/items, raw responses, and SSE events.
• Make Page.getNextPage() throw QoderError at the last page and return Promise<Page<T>>. Automatic iteration still ends normally without an extra request.
• Record the behavior changes under Unreleased and update README/API documentation.

Why

Release notes need a reviewed, version-specific source. An established SSE stream should remain usable beyond the fetch timeout, and callers should be able to log result._request_id directly when diagnosing successful API calls. Manual pagination should report an exhausted page consistently with the agreed Anthropic baseline.

Verification

• npm test: 3,314 passed, including the CommonJS/ESM export checks and offline scenarios.
• npm run build and npm run typecheck.
• npm pack --dry-run.
• Documentation consistency/internal-link checks and 25 README TypeScript snippets compiled.
• Changelog validation and 19 release-notes automation tests.
• Timeout regressions cover long SSE/body reads, middleware, retries, explicit cancellation, and listener cleanup.
• Request-ID tests cover both clients, Promise typing, missing/fallback headers, conflicting JSON fields, serialization, final retry IDs, pagination, arrays, raw responses, and SSE.
• Pagination regressions cover both clients and all three cursor styles: non-null next pages, terminal errors without network calls, preserved filters/options, and normal automatic termination.

Account-backed integration tests and live examples were not run; the changed client behavior is verified offline. GitHub release publication itself was not executed locally.

Impact

Applications that used timeout as a total SSE/download deadline should pass signal: AbortSignal.timeout(...) instead. _request_id is reserved SDK metadata and is omitted by JSON serialization and object spread; it is not added recursively to nested data. Manual loops that stopped when getNextPage() returned null must check hasNextPage() or use async iteration. Public API resource contracts and fixtures do not change. No credentials, live environment files, or test output are included.

Related SDK changes: Go #5, Python #7.