docs(changelog): add CHANGELOG.md to close OpenSSF release_notes (RAN-63)

[aksOps]

Summary

Closes the bestpractices.dev release_notes criterion on project 12646 by adding a Keep a Changelog 1.1.0 file at repo root.

The autofill scans for per-version headers in CHANGELOG.md. Without one, release_notes_status is reported Unmet — No release notes file found, holding the project at 91% (per the board's corrected analysis). With this file in place, an autofill re-run should flip the criterion to Met and close out the project's last unmet criterion.

What changed

• Single new file: CHANGELOG.md (+87 / −0)
• Header documents the convention: Keep a Changelog 1.1.0 format link, SemVer 2.0.0 policy, and the pre-1.0 caveat that Unreleased tracks main between published pre-release tags (per-tag detail stays on GitHub Releases at v0.0.11-beta.*).
• Initial Unreleased entry covers everything currently on main since v0.0.11-beta.15:
  • Added — multi-tenancy end-to-end (GraphRAG, storage, MCP, vector DB), Entra auth + retention, 100–200-service backend robustness, OpenSSF scaffolding (scorecard.yml, security.yml, .bestpractices.json schema, SECURITY.md, CLAUDE.md, README badges).
  • Changed — local CI replacing the deleted central-ops reusable workflow; post-robustness chore consolidation.
  • Fixed — MCP default-tenant fallback (RAN-22), Postgres AutoMigrate FK race (RAN-49), service-map node stacking.
  • Security — OSS-CLI stack adopted as continuous supply-chain surface.
• PR cross-references inline at the bottom of the file.

Out of scope (per RAN-63 description)

• Feature / functional work
• .bestpractices.json schema rewrites — already on main (RAN-58)
• Anything in RAN-53's AC checklist already merged

Test plan

• File renders as valid markdown (Keep a Changelog headers, fenced code, link refs).
• After merge, board re-runs autofill at https://www.bestpractices.dev/projects/12646 and confirms the project flips to `passing`.

Closes RAN-63.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud