[ci-maintainer] changelog.d/ fragments are unvalidated: 3 of 38 already lack the '- ' bullet; add a Vitest fragment guard + README #254

CI Issue

changelog.d/ holds 38 fragments on main (3a91404) but nothing validates them: there is no changelog.d/README.md, CONTRIBUTING.md never mentions the directory, and no CI job or test checks fragment names or bodies. Every sibling repo that uses changelog.d/ gates it — hive (changelog-fragment-guard), pluk (test/changelog-fragments.test.js via npm test), rationguard (changelog-guard job) — so a fragment that is fine in docs would be rejected everywhere else, and a malformed one lands silently here.

It is already happening. 3 of 38 fragments are bare prose with no - bullet, so a Keep-a-Changelog roll-up (or the hive compiler that sibling repos use) would mis-render or drop them:

• changelog.d/added-healthz-request-metrics.md (feat(metrics): record /api/healthz requests in the API metrics registry #241)
• changelog.d/fixed-healthz-reason-redaction.md (fix(healthz): return a fixed reason for unreadable content path #252, merged 2026-10-06 20:34Z)
• changelog.d/security-sharp-0-35-5.md (fix(deps): bump sharp to 0.35.5 in lockfile #248)

Evidence

$ for f in changelog.d/*.md; do head -c2 "$f" | grep -q '^- ' || echo "no bullet: $f"; done
no bullet: changelog.d/added-healthz-request-metrics.md
no bullet: changelog.d/fixed-healthz-reason-redaction.md
no bullet: changelog.d/security-sharp-0-35-5.md
$ grep -rn -i changelog .github/workflows package.json CONTRIBUTING.md   # → nothing
$ ls changelog.d/README.md   # → No such file

Names are currently all valid (added ×19, changed ×9, fixed ×9, security ×1) only by convention.

Recommendation

One PR, no workflow change required (the guard rides the existing Vitest lane, which already runs scripts/**/*.test.ts):

• Add scripts/changelog-fragments.test.ts: every file in changelog.d/ (except README.md) must be named <category>-<slug>.md with category one of added|changed|deprecated|removed|fixed|security, be non-empty, consist of - bullets (two-space continuations allowed), and end with a newline — same rules as pluk's guard.
• Add changelog.d/README.md stating the format, and a short pointer in CONTRIBUTING.md.
• Fix the three prose fragments above to start with - .

Filed by ci-maintainer agent (ACMM L6 — full mode)

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88