Make release-note updates portable and finalize versioned headings

[konn]

Description

Release-note tasks and the CI guard depended on incompatible implementations of yq across environments. The guard also inspected a different TOC section from the one the release tasks updated, allowing unreleased references to go undetected.

Replace these calls with a Python helper using ruamel.yaml, pinned in the existing dev extra and uv.lock. The helper selects the release section by caption, preserves comments, quotes, ordering, and LF/CRLF, rejects conflicting or malformed entries, and validates both TOCs before replacing files. Release tasks perform a dry-run check before changing notebooks, and CI checks the entire TOC for unreleased references.

Finalization renames both language notebook/Markdown pairs, replaces the first X.XX.X in each Markdown release title with the supplied version, and uses Jupytext through uv to regenerate and execute the notebooks from the renamed Markdown. Later placeholders remain unchanged. Explicit Markdown conversion makes it authoritative even when an existing notebook is newer; execution failures stop before the TOC update.

Run all 25 regression tests once in an independent Ubuntu/Python 3.11 job, covering both languages and LF/CRLF cases. Include local Taskfile commands and contributor instructions.

Validation

• All 25 regression tests passed locally on macOS with Python 3.11, 3.12, and 3.13 using the locked dev dependencies.
• Full Taskfile commands passed in clean temporary copies: creating unreleased notes followed by finalization, and finalization with no existing unreleased notes. Authored code cells verified actual execution and fresh outputs for both languages; checks covered first-only title substitution, later placeholders, matching Markdown/notebook inputs, and exact TOC changes.
• Verified that renamed Markdown remains the source even with newer stale notebooks, and that a failing English code cell aborts before Japanese execution or any TOC finalization.
• Repeated creation was rejected without modifying files; invalid versions were rejected before notebook changes.
• task check_book_en and task check_book_ja passed, including full notebook execution and warnings-as-errors builds.
• task check_paired_notebooks passed with a writable temporary JUPYTER_DATA_DIR for the sandbox.
• task check_release_toc, uv lock --check, and git diff --check passed.

Successful notebook runs emitted sandbox-related kernel shutdown diagnostics. Remote CI results are reported by the PR checks.

[NY57]

LGTM!