Validate commit hashes and use hash<TAB>subject format for release notes

[yosriady]

Motivation

• Ensure release-note generation cannot produce malformed or empty commit links by validating commit hashes before creating links.
• Make the git log output unambiguous by emitting the short hash first and separating it from the subject with a real tab.

Description

• Change git log --pretty=format to output '%h%x09%s' so each line begins with the commit hash followed by a tab and the subject.
• Swap the read order to hash message and add a validation that the hash matches ^[0-9a-f]+$, exiting with an error if parsing fails.
• Add comments explaining the security rationale that the loop validates the hash before making links to avoid publishing empty URLs.

Testing

• The release workflow executes pnpm build as part of the job.
• The release workflow executes pnpm test as part of the job and those CI steps completed successfully.

---

Codex Task

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}