fix(changelog): emit one bullet per dependency change

[upbqdn]

Motivation

A dependency whose types are reachable in a crate's public API produced two
### Changed bullets naming the same dependency:

### Changed
- Migrated to `ext_dep 0.30.0`.
- Public dependency `ext_dep` upgraded to `0.30.0` (major); it appears in this crate's public API, so this is a breaking change.

The first comes from the per-crate dependency diff, which emits a line for every
requirement change; the second from the public-dependency reachability join. A changelog
entry is per change and written for the user adapting to it, so this left the curator
merging the two by hand on every such dependency.

Solution

Fold the note into the Migrated to line, keeping the standalone bullet only where no
such line exists:

### Changed
- Migrated to `ext_dep 0.30.0`; its types appear in this crate's public API, so downstream users must upgrade `ext_dep` in lockstep.

The wording stays conditional on the classification introduced in #11: a major change
states the lockstep upgrade, an unknown requirement change only asks for review, so an
unproven change still cannot read as a break.

Stacked on #11, which the fold reuses for that distinction.

Tests

The reachable case now asserts the folded line and guards against a second bullet
appearing beside it. Adds branch coverage for the external Migrated to line itself,
which the fold rewrites in place.

Ran locally: shellcheck -S warning zc tests/run.sh, bash -n zc, bash -n tests/run.sh, tests/run.sh (133 tests, 0 failures).

[upbqdn]

Superseded by #13: GitHub auto-closed this when its stacked base branch was deleted on merge of #11. Same commit, rebased onto main.