[DX] Establish CHANGELOG with migration notes for breaking changes

[khelanmodi]

Goal

Every breaking change documented with a Before: / After: snippet.

What to ship

• CHANGELOG.md at repo root following Keep a Changelog format.
• Backfill entries for PR Add per-profile database and collection allowlists (release-readiness #3) #43 (allowedDatabases: [] semantic flip), PR Per-Profile Role and Capability Restrictions (+ unified undefined / [] semantics, + permission model doc) #44 (allowedRoles default, kill-switch removal), PR Add fine-grained data exposure controls: pipeline namespace enforcement and deny-wins blocklists #47 (denylists, readOnly if it ships).
• Each breaking change has a Migration: block with a concrete config diff.

Acceptance criteria

• CHANGELOG present and current.
• A pre-merge check or contributor guideline that says "if your PR is breaking, add a CHANGELOG entry."
• Release notes link to CHANGELOG.

Why

PR #44's default flip would have been less surprising with a CHANGELOG. As the user base grows this becomes essential.