Stop changelog-notes extractor at <!-- scriv-end-here --> marker

[sderev]

What changed

• .ci/changelog-notes boundary regex now also stops at <!-- scriv-end-here -->.

Why

• The extractor stopped at ## headers and <a id= anchors but not at the trailing scriv marker. Once scriv emits <!-- scriv-end-here -->, the extractor would silently include it in release notes.
• Port of the same fix already applied in shellgenius.

How to test

• Run .ci/changelog-notes 0.3.0 — output should be unchanged (no <!-- scriv-end-here --> in current CHANGELOG).
• Create a test changelog with <!-- scriv-end-here --> after a version section and verify the extractor stops before it:

  echo -e "## 0.0.1\n\nFixed\n-----\n* Bug fix\n\n<!-- scriv-end-here -->\n\n## 0.0.0\n" > /tmp/test-cl.md
  .ci/changelog-notes 0.0.1 /tmp/test-cl.md
  # Should print only "### Fixed\n* Bug fix", without the scriv marker
  
  

Risk/comp notes

• Low risk — adds a stop condition; existing behavior unchanged for CHANGELOGs without the marker.

Changelog fragment: no (internal CI tool, no user-visible behavior change)