Twig's release was a checklist: bump build.zig.zon, remember that two Rust
manifests and a lockfile carry a copy of that number, regenerate the changelog
region, rename `## Unreleased` by hand, commit, tag, push. fig and prov each
grew a tool for exactly that; this is twig's.

zig build release -- <version|major|minor|patch|as-is> [--push] [--no-verify]

preflight, bump, verify, changelog, commit, tag, stop. It stops at the tag
unless given `--push`, and prints the two commands it did not run — everything
before the push is a local commit that can be thrown away, and the push is the
one that spends a crates.io version number for good.

Preflight refuses a release that is already doomed: dirty tree, wrong branch,
behind origin, no git-cliff, a tag that exists locally or on origin, a version
the crates.io sparse index has already seen (asked for every crate in
Cargo.lock, since a tag is not the only way a number gets spent), or a
CHANGELOG whose marker pair is missing, doubled, or not in `## Unreleased`.
After the bump every failure runs `git checkout -- .`, which is exact because
preflight proved the tree was clean.

Three things it needed that did not exist:

* `scripts/sync-version.sh --set X.Y.Z` moves the source of truth and
propagates, so the release tool never learns which files carry a version.
The script now also covers bindings/rust/Cargo.lock, which recorded the
members' own versions and was being left behind by every bump, and both
modes derive from one desired-content function so `--check` and the write
path cannot disagree.
* `zig build check`, the pre-release gate: version sync, build, tests, the C
ABI library, and the Rust binding suite via scripts/rust-check.sh, which
sets TWIG_SYS_FORCE_SOURCE=1 so a stale prebuilt archive cannot make the
working tree pass for the wrong reason.
* the changelog **cut**, which renames `## Unreleased`, strips the marker
lines out of the section that just became history, and opens a fresh empty
one above. 3.2.0 was cut by hand and left the markers inside it, so the
next `changelog.sh --write` would have rewritten a released section; this
commit repairs that and the tool's parse now refuses the shape outright.

Also: release.yml passed `config: cliff.toml` to git-cliff, and the config has
lived at `.config/cliff.toml` since it moved there — the release-notes step
would have failed on the next tag.

The symbol has been in the C ABI and the header since v4 and was never
declared in `twig-sys`, so no Rust caller could reach it — which is why
finding an attribute block's extent from Rust meant scanning the source for
a `{` near the node.

`Document::attrs_span` follows `content_span`/`marker_span`: `Ok(None)` for
TWIG_STATUS_NOT_FOUND, which is the answer for a set with no single recorded
range and not an error. No ABI change; the symbol was already exported.