ci: check the release notes before building (#716)

The CHANGELOG.md section was read after composer, pnpm and the frontend
build had all run, so tagging without notes spent a full build before
failing on something knowable in the first seconds. It only needs PHP, so
it now runs directly after the PHP setup.

Noticed while dry-running a tag with no section against #715: the run
correctly refused to publish, but took a whole build to say so.

.github/workflows/release.yaml

@@ -40,6 +40,16 @@ jobs:
           extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
           tools: composer
 
+      - name: Read the release notes from CHANGELOG.md
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          if ! php .github/scripts/changelog-section.php "$TAG" > /tmp/notes.md; then
+            echo "::error::No CHANGELOG.md section for $TAG — add one before tagging."
+            exit 1
+          fi
+          echo "Using the CHANGELOG.md section for $TAG"
+
       - name: Install pnpm
         uses: pnpm/action-setup@v6
 
@@ -57,16 +67,6 @@ jobs:
       - name: Build the release package
         run: make clean dist
 
-      - name: Read the release notes from CHANGELOG.md
-        env:
-          TAG: ${{ github.ref_name }}
-        run: |
-          if ! php .github/scripts/changelog-section.php "$TAG" > /tmp/notes.md; then
-            echo "::error::No CHANGELOG.md section for $TAG — add one before tagging."
-            exit 1
-          fi
-          echo "Using the CHANGELOG.md section for $TAG"
-
       # Created as a draft with the package already attached, then published as a
       # separate step. `release: published` therefore fires only once the tests
       # have passed and the asset is in place, so downstream registration can