docs(changelog): roll [Unreleased] into v0.28.0 — backfill 20 missing…

… bullets (#2864)

Completeness audit over the 52 commits since v0.27.0 found 20 shipped
changes with no [Unreleased] bullet; each is backfilled from its actual
PR body + diff, then the section rolls to ## [0.28.0] - 2026-08-07.

Backfilled: per-tick sensor evidence + trend query (#2756/#2810), sensor
state-confirmation retries (#2799/#2805), notify_email recipient list
(#2764/#2812), tls_inspect days_to_expiry (#2772/#2808), gh Projects-v2
board ops at loader-wired (#2081/#2823), meho login --print-token
(#2782/#2786), machine review identity + DCO remediation (#2788), agent
run-turns counter (#2743/#2818), datastore.usage vm_names bound
(#2758/#2811), no_connector names product (#2701/#2766), unowned sensor
identity_sub rejected (#2699/#2767), argocd proposed_effect envelope
(#2681/#2769), MCP conformance gaps (#2746/#2820), meho-mcp client-id +
loopback redirect defaults (#2779/#2783/#2785, #2793/#2795, #2796/#2797),
docs-site reachability gate (#2741/#2821), trivy SARIF-on-failure
(#2740/#2803), vmware vCenter-capable fingerprint chain (#2765/#2790),
curl-recipe token capture (#2787/#2789), bootstrap-clients wording
(#2792/#2794).

Routine dependabot version bumps carry no bullets per convention; the
CVE-driven bumps are already under Security (#2798).

Signed-off-by: Damir Topic <89133183+damir-topic@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.27.0 (#2762)

Rolls the #2745 breaking MCP tool-name rename (retitled under the
established '### Breaking changes' heading, per the category
convention that migrations surface above features) and backfills the
two docs PRs shipped since v0.26.0 that had no bullet: the
internal-only MCP client-setup correction (#2744) and the docs-site
Project section de-stub (#2747). Completeness audit: 3 PRs since
v0.26.0 (#2748, #2747, #2744) — all now cited. Fresh empty
[Unreleased] left behind.

Signed-off-by: Damir Topic <89133183+damir-topic@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.26.0 (#2739)

Release-cutting commit per docs/RELEASING.md Phase 2: completeness
audit done (all non-chore PRs since v0.25.0 carry a bullet; deps/style/
test chores excluded per existing convention), four missing PR anchors
added (#2704, #2735, #2736, #2737), narrative intro added, and the
[Unreleased] section reset to empty.

Signed-off-by: Damir Topic <89133183+damir-topic@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.25.0 release notes (#2641)

Cuts v0.25.0 on 45 PRs since v0.24.0: the complete G0.32 + G0.33
dogfood-hardening cycle, the full G0.36 GSM-deploy set (incl. the
check-runner target-resolution fix), check-layer follow-ups, the
/ui/runners + /ui/sensors + meho-dashboard visibility pages, the
vmomi VI-JSON mount fix, and the CodeRabbit retirement. Completeness
audit: every merged PR carries a bullet citing its issue; the single
gap (#2588, merged after the v0.24.0 tag) is backfilled here with the
wording from PR #2593, which this supersedes. No new migrations —
chain head stays 0067. No version files touched; version lives in
the tag.

Refs #2588

Signed-off-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.24.0 release notes (#2584)

Cut v0.24.0 — completes Broadcast v2 (Initiative #2543): durable
agent_announcement table + retention prune + DB backfill + real event
UUIDs (#2565), humans-see-announcements SSE/console/CLI (#2564), and the
dispatch-time target-activity advisory (#2567). Also topology MCP
bulk_import + annotate `superseded` (#2582), RDC repository_dispatch
retire (#2578), targets-import list-envelope fix (#2581), Sensors &
Dashboards fast-follow (#2574), and the docs retire/rehome (#2579, #2580).

Completeness audit: all 9 PRs merged since v0.23.0 carry a bullet;
[Unreleased] left empty for the next cut.

Signed-off-by: Damir Zubanovic <dzubanovic@evoila.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.23.0 (#2572)

Cut the v0.23.0 section (2026-07-17). Backfills the uncited work: the
Topology v2 (#2555/#2560/#2562) and Broadcast v2 (#2556/#2557/#2558/#2563)
feature sets, the operator-console polish cluster, and a dependency-bumps
rollup. Corrects two stale gateway migration numbers (#2499 0059→0060,
#2501 0061→0062) and adds the missing #2571 cite. Leaves a fresh empty
[Unreleased].

Signed-off-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.22.0 (#2465)

Cut the v0.22.0 section (2026-07-13) covering two new connector
families (net.* diagnostics, rke2-ssh cluster-node OS-lifecycle),
the MFC live-appliance auth fixes, the credential-backend seam
last-mile, and the Helm chart cold-install fixes. Leaves a fresh
empty [Unreleased] for the next cut.

Signed-off-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

chore(cli): regen OpenAPI snapshot for the #2384 route-docstring delta (

#2389)

* chore(cli): regen OpenAPI snapshot for the #2384 route-docstring delta

PR #2384 updated the kb_editor_save route docstring (the 200-on-
recoverable-error mold note) without regenerating the CLI snapshot,
turning the 'CLI API snapshot freshness' lane red on main. Docstring-
only delta: no schema, path, or client-shape change; client.gen.go is
byte-identical after regen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: damir-topic <89133183+damir-topic@users.noreply.github.com>

* docs(changelog): cite the snapshot-regen follow-up in the #2384 block

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: damir-topic <89133183+damir-topic@users.noreply.github.com>

---------

Signed-off-by: damir-topic <89133183+damir-topic@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs(changelog): roll [Unreleased] into v0.20.0 release notes (#2226)

Cut the v0.20.0 CHANGELOG section (2026-07-08) and backfill every merged
PR since v0.19.0 that lacked an [Unreleased] bullet: the #101 extended
security batch (#2057-2064), the runbooks-UI hardening wave, connector
features/composites (hetzner-rest, vmware host.network_uplinks +
host.vsan_health, holodeck disk.usage + remediation writes), the
policy-gate audit verdict + docs-search grounding features, secret read,
the servers[].url base-path fold (#2075), plus CI/dependency changes.
Leaves a fresh empty [Unreleased]. Docs only.

Signed-off-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: damir-topic <damir.topic@ed-consulting.at>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

docs(changelog): roll v0.19.0 + drop stale README version token (#2051)

Phase 2 of the v0.19.0 release cut. Moves the [Unreleased] section under ## [0.19.0] - 2026-06-22 and opens a fresh empty [Unreleased].

The mandatory completeness audit found ~22 merged PRs since v0.18.0 with no [Unreleased] bullet — chiefly the entire operator-console wave (Goal #336: Vault/Keycloak/topology/audit consoles, account page, broadcast overrides, retrieval tabs, ingest modal, profiled-connector surfacing), plus the ExecutionProfile-schema task (#1988), several connector/MCP/docs-search fixes (#2002/#2020/#2016/#2004/#2001), two CI items (#1982/#1987), a docs reconcile (#2032), and 7 dependency bumps. All backfilled with correct ship-states; every commit since v0.18.0 is now represented.

Also drops the stale '**Status:** v0.9.0' token from the README (it had drifted 9 releases behind the latest tag, reddening README Version Check); the self-updating release badge now carries the version, so it cannot drift again.

Signed-off-by: damir-topic <damir.topic@pmsoft.at>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>