fix(release-notes): pass GH_TOKEN, random GITHUB_ENV delimiters, strip only .git

[crowecawcaw]

What was the problem/requirement? (What/Why)

Three issues in the release-notes path, found while reviewing the Claude review tooling:

1. PR descriptions were never used. generate_release_notes.py reads each PR's description with gh pr view, but the bump workflow's GenerateChangeLog step set no GH_TOKEN. In Actions gh failed, the failure was ignored without a message, and the notes were built from commit messages alone.
2. A fixed heredoc delimiter for model output. reusable_bump.yml, reusable_publish.yml, and reusable_publish_v2.yml write the release notes to $GITHUB_ENV between <<EOF and EOF. The notes are model output steered by commit and PR text, so a line reading EOF would end the value early, and the lines after it would set env vars for later steps in the job, including the ones holding CI_TOKEN.
3. remote.rstrip(".git") strips any trailing ., g, i, or t characters rather than the suffix, so openjd-cli.git became openjd-cl. Local runs only; the workflow passes --repo.

What was the solution? (How)

1. Pass GH_TOKEN: ${{ github.token }} to GenerateChangeLog; the job already has pull-requests: write. The script now warns on stderr when gh pr view fails.
2. Use a random delimiter (ghadelimiter_$(openssl rand -hex 16)) for all three writes, and quote "$GITHUB_ENV". No other GITHUB_ENV/GITHUB_OUTPUT write in the repo writes multi-line untrusted text.
3. removesuffix(".git").

What is the impact of this change?

Release notes get PR context again. Release notes can no longer set env vars for the later steps of the bump and publish jobs.

How was this change tested?

• New unit tests, each failing before its fix: GetPrDescriptionsTest.test_gh_failure_is_warned_not_silent and RepoNameFromRemoteTest.test_names_ending_in_suffix_letters_are_kept. All 62 tests pass (python -m unittest discover -s test).
• The delimiter change is YAML-only. I ran the pattern locally with notes containing an EOF line followed by GH_TOKEN=evil; both stayed inside the value.
• actionlint shows no new findings, and 4 fewer (the unquoted $GITHUB_ENV warnings). zizmor 1.23.1 reports the same findings before and after.
• Not run end-to-end: a bump or publish on a fork. The first real run happens after merge.

Was this change documented?

In workflow comments.

Is this a breaking change?

No.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.