chore: assemble the changelog with towncrier, as SpyDE and anyplotlib do

[CSSFrancis]

Both open pull requests — #2 and #4 — added a block under ## [Unreleased], so
both conflicted with main over the same four lines. Neither conflict was about
the change. A shared changelog file makes every concurrent PR contend for one
spot; a fragment per PR does not.

What this does

Same layout SpyDE and anyplotlib already use: a news fragment per pull request
under upcoming_changes/, named {PR}.{type}.rst, assembled into
CHANGELOG.rst by towncrier build at release time. The type list is SpyDE's
(the fuller one — it has performance), with behaviour changes leading the
notes, where an app upgrading cannot miss them.

Two places this differs from SpyDE, both deliberate:

• package = "de_shell" is set. SpyDE has to pass --version explicitly
  because its version of record is electron/package.json. Here it is
  de_shell.__version__ — the thing publish.yml refuses to disagree with —
  so towncrier reads the version itself.
• There is no Prepare Release workflow here, so assembling the notes stays
  a documented manual step in the README's Releasing section. That includes the
  trap SpyDE's workflow comments on: towncrier deletes the fragments it
  consumes, so the release commit needs git add -A upcoming_changes, or the
  deletions go unstaged and the next release re-publishes them.

uv tool run towncrier rather than SpyDE's uvx: unlike SpyDE's, this command
is run locally rather than by CI, and uvx is not installed everywhere uv is.

CHANGELOG.md → CHANGELOG.rst

0.2.0 through 0.2.2 are carried over rather than truncated the way SpyDE's were
at 0.4.0 — it is 80 lines, not worth losing to a format change. The Changelog
URL in pyproject.toml, the README's release steps and a Rules bullet follow it.

Checked

uv tool run towncrier build --draft renders the existing entries and the new
fragment; both RST files parse clean under docutils. uv run pytest -q 97
passed, npm run typecheck clean, npm run test:unit 0 fail.

Merge order

This wants to land first: #2 and #4 are rebased on top of it, each carrying its
own fragment instead of a CHANGELOG hunk.