docs(repo): add the missing changelog entry for delta 9638049af0fa

[marcusjacobson]

Summary

Adds the template-side changelog entry that #150 should have carried.

That PR ported six tenant-neutral files (delta 9638049af0fa, merged 3fc0670) but touched only the six code files. Both prior ports authored an entry:

## 2026-07-30
- **sync:** port the operations-repo delta cde888650b78 — 22 tenant-neutral files…
## 2026-07-25
- **sync:** port the operations-repo delta 64fa18c2ac6f — six tenant-neutral files…

The operations repo's upstream-scope.yaml marks CHANGELOG.md as own-changelog for exactly this reason: a port carries code, and the receiving repo writes its own entry. Missing it left this repo's history with no record of the batch.

What the entry covers

Both batches in delta 9638049af0fa, at the level of detail this file's existing entries use:

• CI error handling — pr-owner-gate.yml and pr-auto-merge.yml: gh writes the HTTP response body to stdout even on an error, so a command substitution that discards stderr and never checks the exit code turns a failure into a value. Covers the corrupted PATCH URL, the rollup that reported "all checks are passing" because the API call failed, the wait-for-merge scope gap that meant the job had never once succeeded, the unreachable UNKNOWN sentinel, and the per-PR concurrency group. Also records what was deliberately not changed and why — the nine remaining bare gh reads are merge gates that should fail closed, and validate-oidc-auth.yml's az call behaves differently because the Azure CLI writes errors to stderr.
• DLP — the -NotifyUserType location gate in Deploy-DLPPolicies.ps1, including why a mixed bucket set still emits deliberately.

Scope

• docs/** or README.md — CHANGELOG.md only

One file, six insertions. No code, no workflow, no test is touched.

Validation

git diff --stat: CHANGELOG.md | 6 ++++++

Heading order (reverse chronological, per the file's own convention):
  19: ## 2026-08-17
  25: ## 2026-07-30
  31: ## 2026-07-25
  37: ## 2026-07-23

Embedded docs gate: current (5 docs; this repo's landing pages do not embed CHANGELOG.md).

Per this file's maintenance rule 4 — "A PR whose only change is this file (a manual changelog fix) does not add an entry for itself" — this PR adds no entry about itself.

Rollback plan

Revert the single commit. The changelog returns to having no record of delta 9638049af0fa.

[github-actions]

Owner Gate

Missing needs-review label. This PR was not filed through @idea-intake. Add the label manually if this is intentional.

---

This comment is maintained automatically by the pr-owner-gate workflow. It updates on every push and label change. Re-toggle the needs-review label to refresh after a check completes.