📝 docs(decisions): record D-126/D-127 and regenerate CHANGELOG.md

[konih]

Two operator rulings that were sitting uncommitted in the working tree, plus the CHANGELOG regeneration that main needs to go green again.

What

• D-126 — D-031 domain string DEFERRED (operator ruling); assent.dev stays for now.
• D-127 — SEC-05 HOMEBREW_TAP_GITHUB_TOKEN classic→fine-grained PAT rotation SCHEDULED, not immediate.
• Regenerated CHANGELOG.md (D-125 drift gate) covering the five dependabot bumps and the AUD-S18 merge.

Rows are inserted in numeric position (D-125 → D-126, D-127 → D-128), not appended — the table has been strictly ascending since D-001. Neither ID was claimed on main or on either in-flight lane.

Why the regeneration is needed

main is red on changelog-verify. Verified: it was already red at 876c268 (the v0.2.0 tag commit) — tagging makes git-cliff render ## [0.2.0] where the committed file still said Unreleased. The dependabot merges and #38 added further drift on top. This commit clears all of it.

Gates

• task changelog-verify — ok
• task docs-gates — all truth-lag pins green

Note: task check is red on a pre-existing, local-only defect unrelated to this PR — release-changelog-gate-test §6's polarity control. Reproduced on pristine origin/main. Two commit subjects inside the v0.2.0 section literally contain pins.toolDigest, so the note-grep matches the body and the control correctly reports its own positive assertion as vacuous. That gate does not run in CI (verify runs only task changelog-verify), so it is invisible there. Filed for its own lane; deliberately not fixed here.