Rename the metadata tree to changes/<ulid>/change.md

Why

The web interface, the CLI, and the docs call these items changes. The metadata branch still spells the tree requests/<ulid>/request.md, so the format contradicts the product every time someone reads the branch or the docs. Rename the tree to changes/<ulid>/change.md so there is one word for one thing.

This is a format change. It needs a planned rewrite of each repository’s vole branch, not only a code edit.

Scope

• requests/ becomes changes/.
• request.md becomes change.md.
• Keep approvals/, comments/, the frontmatter fields, ULIDs, and #N numbering unchanged.
• The web URL namespace (/r/<repo>/requests/...) is out of scope; keeping it avoids breaking links. A later change can add /changes/ routes with redirects.
• Internal Go names (metadata.Request, vole change) stay; only the on-disk format changes.

Checklist

• Change the metadata directory and file-name constants and the path parsers.
• Update writers, validation, the closed-layout rule, index refresh and touch times, push-event parsing, hook scope and quota, and the landing hint.
• Update the change-request page hint and the format docs.
• Update the test fixtures that spell the paths literally.
• Document the upgrade order: the server must run the new binary before the rewritten branch is pushed.
• Rewrite the live vole branch with an audited admin force-push, keep a backup, and verify the #N aliases are unchanged and the index rebuilds.

Migration notes

Dry run on a copy of this repository’s live vole branch: rewriting both paths keeps all 555 commits, their subjects, author and committer dates, and blob ids. The #N sequence is unchanged because it is the creation-commit rank. The instance rebuilds its index automatically when the pushed tip is not a descendant of the stored one, resets the metadata event cursor instead of replaying events, and the CLI force-fetches the ref.

Caveat: pre-receive sees a moved approvals/<account>.md as an added approval by that account, so an admin rewrite is rejected if any approval by another account exists at migration time. This repository currently has none. Migrate before approvals accumulate, or add a first-class rewrite path.

Acceptance criteria

• Writing a change lands at changes/<ulid>/change.md; the metadata branch rejects requests/ and request.md with a clear message.
• vole change list|show|approve|comment, issue links, landing, and the web pages work.
• vole workflow check and the verify workflow pass.
• The live branch is rewritten, vole admin index rebuild agrees, and every #N alias still names the same ULID.