feat(changelog): add git-cliff changelog target and init scaffolding

Sync Makefile with dev-toolchain: add `make changelog` / `_changelog`
target, git-cliff to tool-versions report, cliff.toml to `make init`.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: matthew-on-git

DEVELOPMENT.md

@@ -52,8 +52,10 @@ Every DevRail-managed repo exposes these public targets:
 | `make security` | Run security scanners (bandit, tfsec, checkov, etc.) |
 | `make scan` | Run universal scanners (trivy, gitleaks) |
 | `make docs` | Generate documentation (terraform-docs, tool version report) |
+| `make changelog` | Generate CHANGELOG.md from conventional commits (git-cliff) |
 | `make check` | Run all of the above in sequence |
 | `make install-hooks` | Install pre-commit hooks |
+| `make init` | Scaffold config files for declared languages |
 
 ### Naming Rules
 
@@ -273,6 +275,7 @@ type(scope): description
 | `container` | Dev-toolchain container image |
 | `ci` | CI/CD pipeline configuration |
 | `makefile` | Makefile targets and patterns |
+| `changelog` | Changelog generation and git-cliff config |
 | `standards` | DevRail standards documentation |
 
 ### Code Comments

Makefile

@@ -44,8 +44,8 @@ HAS_JAVASCRIPT := $(filter javascript,$(LANGUAGES))
 # ---------------------------------------------------------------------------
 # .PHONY declarations
 # ---------------------------------------------------------------------------
-.PHONY: help lint format test security scan docs check install-hooks init
-.PHONY: _lint _format _test _security _scan _docs _check _check-config _init
+.PHONY: help lint format test security scan docs changelog check install-hooks init
+.PHONY: _lint _format _test _security _scan _docs _changelog _check _check-config _init
 
 # ===========================================================================
 # Public targets (run on host, delegate to Docker container)
@@ -57,6 +57,9 @@ help: ## Show this help
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | \
 		awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}'
 
+changelog: ## Generate CHANGELOG.md from conventional commits
+	$(DOCKER_RUN) make _changelog
+
 check: ## Run all checks (lint, format, test, security, scan, docs)
 	$(DOCKER_RUN) make _check
 
@@ -704,6 +707,7 @@ _docs: _check-config
 		fi; \
 		_tv trivy "trivy --version"; \
 		_tv gitleaks "gitleaks version"; \
+		_tv git-cliff "git-cliff --version"; \
 		printf '}}\n'; \
 	} > .devrail-output/tool-versions.json; \
 	generators="$${generators}\"tool-versions\","; \
@@ -716,6 +720,34 @@ _docs: _check-config
 	fi; \
 	exit $$overall_exit
 
+# --- _changelog: generate CHANGELOG.md from conventional commits ---
+_changelog: _check-config
+	@start_time=$$(date +%s%3N); \
+	config=""; \
+	if [ -f "cliff.toml" ]; then \
+		config="cliff.toml"; \
+	elif [ -f "/opt/devrail/config/cliff.toml" ]; then \
+		config="/opt/devrail/config/cliff.toml"; \
+	fi; \
+	if [ -z "$$config" ]; then \
+		echo '{"target":"changelog","status":"error","error":"no cliff.toml found","exit_code":2}'; \
+		exit 2; \
+	fi; \
+	if ! git rev-parse --git-dir >/dev/null 2>&1; then \
+		echo '{"target":"changelog","status":"error","error":"not a git repository","exit_code":2}'; \
+		exit 2; \
+	fi; \
+	git-cliff --config "$$config" --output CHANGELOG.md; \
+	cl_exit=$$?; \
+	end_time=$$(date +%s%3N); \
+	duration=$$((end_time - start_time)); \
+	if [ $$cl_exit -eq 0 ]; then \
+		echo "{\"target\":\"changelog\",\"status\":\"pass\",\"duration_ms\":$$duration,\"config\":\"$$config\",\"output\":\"CHANGELOG.md\"}"; \
+	else \
+		echo "{\"target\":\"changelog\",\"status\":\"fail\",\"duration_ms\":$$duration,\"config\":\"$$config\",\"exit_code\":$$cl_exit}"; \
+		exit $$cl_exit; \
+	fi
+
 # --- _init: scaffold config files for declared languages ---
 _init: _check-config
 	@created=""; \
@@ -748,6 +780,12 @@ _init: _check-config
 	  '' \
 	  '[*.sh]' \
 	  'indent_size = 2'; \
+	if [ -f "/opt/devrail/config/cliff.toml" ] && [ ! -f "cliff.toml" ]; then \
+	  cp /opt/devrail/config/cliff.toml cliff.toml; \
+	  created="$${created}\"cliff.toml\","; \
+	elif [ -f "cliff.toml" ]; then \
+	  skipped="$${skipped}\"cliff.toml\","; \
+	fi; \
 	if [ -n "$(HAS_PYTHON)" ]; then \
 	  scaffold ruff.toml \
 	    'line-length = 120' \