fix(changelog): one spelling per version, and check before replacing

`release 00.5.0` passed the newer-version guard (its key equals 0.5.0's)
and the exact-string duplicate check, then wrote `## [00.5.0]` and deleted
the entries before `check` rejected the file (Pullfrog on #82).

- Versions take no leading zeros, in `release`, `notes` and the headings
  `check` accepts.
- `release` checks the file it is about to write and changes nothing
  unless it passes, so any other bad result also leaves CHANGELOG.md and
  the entries as they were.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

scripts/changelog-test.sh

@@ -102,6 +102,10 @@ reset
 printf '\n## 0.3.0\n' >>"$work/CHANGELOG.md"
 expect_check_error "a malformed version heading" 'version headings read'
 
+reset
+printf '\n## [0.03.0] - 2026-01-01\n' >>"$work/CHANGELOG.md"
+expect_check_error "a version with a leading zero" 'version headings read'
+
 # --- release -----------------------------------------------------------------
 
 # b-feature.md cites a lower PR than a-fix.md, so it comes first.
@@ -193,6 +197,9 @@ if err="$(changelog release 0.4.9 2026-11-06 2>&1)"; then
 elif ! grep -q "older than 0.5.0" <<<"$err"; then
   fail "release of an older version said: ${err}"
 fi
+if changelog release 00.5.0 2026-11-06 >/dev/null 2>&1; then
+  fail "release accepted a version with a leading zero"
+fi
 [[ -f "$work/changes/unreleased/again.md" ]] || fail "a refused release deleted the entries"
 diff -q "$expected" "$work/CHANGELOG.md" >/dev/null || fail "a refused release changed CHANGELOG.md"
 rm "$work/changes/unreleased/again.md"