ci: replace npx changelog call with npm script and fix prepare-release workflow

[SamuelSSalazar]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

Fixes the Prepare Release workflow, two bugs introduced by #1020, and hardens changelog generation for reproducibility.

The Detect Next Version step ran semantic-release --dry-run --verify-conditions false. That flag only skips the verifyConditions step. The verifyRelease step still executed the @semantic-release/exec plugin's verifyReleaseCmd, which runs npm pack and then rl-wrapper. As a result:

• rl-wrapper: not found : that binary is only installed inrelease.yml, not prepare-release.yml, so the step fails.
• A stray .tgz in the release PR : npm pack leaves *.tgz in the workspace, which create-pull-request then commits into the release PR.

This PR fixes both issues by adding --verify-release false so the dry-run only runs analyzeCommits (still using the conventionalcommits preset from .releaserc.json), and never triggers npm pack / rl-wrapper.

This PR also updates changelog generation to avoid runtime package resolution in CI:

• Adds a local changelog script in package.json
• Pins maintained changelog tooling in package.json
• Replaces direct npx changelog invocation in prepare-release workflow with npm run update-changelog

Testing

Ran the dry-run command locally and verified that:

• Version detection works: The next release version is x.y.z is printed and captured by the awk pipeline.
• No .tgz is created.
• No rl-wrapper invocation.
• Changelog update runs via npm run update-changelog using local project dependencies.