fix(release): keep the release notes to what a human wrote

[stefanoverna]

Two problems in bin/publish.sh, both found while backporting it to
js-rest-api-clients, where nine packages move in lockstep instead of two.

packages() broke during a release rehearsal

It asked npm for the workspace locations. npm query resolves those through
node_modules — which, in the rehearsal described in our migration notes, is a
symlink to a different checkout. So it answered with paths like
../../../../Users/.../js-rest-api-clients/packages/cma-client, pointing
outside the copy being rehearsed, and the changelog lookup found nothing:

awk: can't open file ../../../../../../../Users/stefanoverna/dato/js-rest-api-clients/packages/cma-client/CHANGELOG.md

The rehearsal is a documented verification step, so this would have read as "the
script is broken" to whoever ran it. The package list is now read straight off
the filesystem from the workspaces globs, which needs no node_modules at all
— and it skips private packages, which are never published anyway.

Release notes were mostly bookkeeping

Every package in a fixed group gets a changelog entry saying the others moved:

### Patch Changes

- Updated dependencies [5b90e51]
  - datocms-plugin-sdk@2.2.7

With two packages that's one wasted section. With nine it was 46 lines of
release notes carrying one line of actual content.

A package now gets a section only if its entry has a bullet that is neither
Updated dependencies nor a bare pkg@version. So nothing is lost, but nothing
restates the release either. A footer lists every package published at that
version, so a package with no prose doesn't silently vanish from the notes:

## datocms-plugin-sdk

### Patch Changes

- 5b90e51: Pin the `@datocms/cma-client` and `emoji-regex-xs` dependencies, ...

---

Released in lockstep:
- datocms-react-ui@2.2.7
- datocms-plugin-sdk@2.2.7

Verified

• Both helpers run against the real v2.2.7 changelogs — the block above is
  their actual output.
• And against a nine-package rehearsal of js-rest-api-clients
  (changeset version on a scratch copy), which is what surfaced both problems:
  46 lines down to 9 plus the footer.
• has_prose was checked on six cases, including the one that could bite it: an
  entry whose prose begins with a pkg@version (- @datocms/cma-client@6 is now required, and the old client is gone.) is kept, while a bare
  - @datocms/rest-client-utils@5.9.0 is dropped.