docs: add living BragStack changelog

[mergemaven11]

What this adds

• Adds a canonical repository CHANGELOG.md for notable merged BragStack changes.
• Seeds the history from recent merged PRs only; open/draft/superseded work is not represented as shipped.
• Uses clear Added / Changed / Fixed / Security categories and PR numbers for traceability.
• Documents maintenance rules so future release notes stay consistent.

Operating model

• CHANGELOG.md is the canonical engineering source.
• Google Drive has a readable BragStack Changelog copy for operating/data-room use.
• Future customer-facing “What’s New” notes should summarize this source without exposing unnecessary internal security implementation detail.

Merge gate

Do not merge unless the branch is current with main, all required status checks are green on the exact current head, the PR is mergeable, and there are no unresolved blocker comments/reviews.

[mergemaven11]

Superseded by #203 during the Tuesday/Friday engineering sweep. #198 was stale/conflicted after newer main changes; #203 rebuilt the same changelog foundation from current protected main, added the already-landed #199 operational entry, passed Backend/Frontend/Security CI on its exact head, and merged safely.