Add blog post creator script

[scriptautomate-bc]

Summary

Adds scripts/new-blog-post.py, a generator for the site's most repetitive blog post types — GA/bugfix releases, release candidates, and security/CVE advisories — plus the supporting config it depends on (scripts/releases.toml, scripts/release-log.toml, scripts/tags.toml validation via scripts/validate-tags.py).

Rather than embedding each post type's body copy as Python string literals, all body content lives in plain Markdown files under scripts/blog-templates/, each with a small number of $placeholder variables (e.g. $version, $major, $track). These are ordinary, readable .md files — a human or an AI can open one directly and write a post by hand from it, with or without this tooling, and editing a template's wording changes every future post of that type without touching Python.

Every template was checked against the actual latest published posts of each type (not just written from memory) and revised to match current house style exactly — see Verification.

What changed

• scripts/new-blog-post.py — generates release, rc, security, and announcement posts. Handles file naming/front matter conventions, --publish vs. default draft: true, and same-day filename collisions.
• scripts/blog-templates/ — one or more .md templates per post type:
  • release-ga-body.md / release-bugfix-body.md — single-version release, split by whether the version is an actual x.0 GA promotion.
  • release-multi-version-block.md — one block per version in a combined multi-version release post.
  • install-upgrade-notes-versioned.md, reporting-feedback.md — shared sections for single-version release posts.
  • installation-notes-simple.md, reporting-issues-simple.md — shared simplified sections for RC and multi-version posts.
  • rc-intro-block.md — release candidate body.
  • security-body.md, security-release-notes-block.md — security/CVE advisory body and its per-version release-notes block.
  • announcement-body.md — placeholder body for general announcement posts.
• scripts/_blog_common.py — shared helpers: approved-tag/release-track/release-log loaders, and a new render_template() that loads a scripts/blog-templates/*.md file and fills in its $placeholders via stdlib string.Template (no new dependency).
• scripts/releases.toml — per-major-version release track (LTS/STS/RC) lookup.
• scripts/release-log.toml — log of every version ever announced, pre-populated from this repo's blog post history; used to reject duplicate or out-of-sequence version announcements.
• README — documents the new-blog-post.py usage, the templates directory, and the release-log/releases-toml conventions.

Verification

Every template was diffed byte-for-byte against real published posts before being finalized, not just visually compared:

• Single-version release (GA and bugfix) — verified against 3008.0 (true GA) and 3008.2 (bugfix): generated output is byte-identical modulo the version string.
• Release candidate — the two most recent RC posts (rc3, rc4) use a different structure than the two before them (rc1, rc2); the template was rebuilt to match the current style and verified byte-identical against the real rc4 post.
• Multi-version release block — no standalone multi-version-only post exists since that same style change, but rc3 (a combined bugfix+RC post) includes a bugfix block for 3006.25; the template was rebuilt to match and verified byte-identical against that block.
• Security/CVE advisory — verified against the most recent genuine CVE-release post (2025-11-20); needed no changes. (The single most recent security-tagged post is a bespoke supply-chain-incident notice, not a repeatable template case, and was intentionally not modeled.)
• Announcement — trivial placeholder body, unchanged from the original.
• scripts/validate-tags.py still passes against all existing posts.
• A correction made mid-review was itself re-verified against evidence: an earlier pass had split the release "Reporting Issues & Feedback" wording by GA-vs-bugfix status on editorial grounds, but checking all five real posts published since the current style was adopted (3008.0, 3008.1, 3008.2, 3006.26, 3006.27) showed all five use identical wording regardless of GA status. Reverted to match observed reality rather than editorial judgment.

Not in this PR

• No new command for a combined "bugfix + RC in one post" type (the shape seen in rc3), since the ask here was to bring existing templates up to date, not add new post-composition features. The per-version block templates (release-multi-version-block.md, rc-intro-block.md) are already structured so that composing them into a single combined post later would be straightforward if that's ever wanted.