📝 chore(release): regenerate CHANGELOG after the codeql-action dependabot bumps

[konih]

Why

main is red at 34e94cf. Two dependabot commits (cd4dac1, 34e94cf, bumping
github/codeql-action/{init,analyze} 4.37.7 -> 4.37.8) merged without regenerating
CHANGELOG.md, so the drift gate fails in both jobs of verify:

• verify -> step changelog drift gate (AUD-S02 - REQ-AUD-S02-02)
• release-exitgate -> task check stage 21 changelog-verify (RELSE-01/AUD-S18)

Run 32817735039. The last green commit is e2e7691 (the E10-S00 merge), where both
jobs passed.

What

task changelog-write output, committed verbatim - the exact four lines CI predicted:

### Chores
- build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8
- build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8

The subject uses the :memo: chore(release): form that cliff.toml:119 skips, so
this commit does not add itself and re-create the drift it fixes. Verified: after
committing, task changelog-verify re-runs clean.

Verification

• task check EXIT=0 locally (all 21 stages)
• task changelog-verify clean after the commit exists

Recurrence

This is the structural consequence of RELSE-08 (release-exitgate skips on PRs):
a dependabot PR can go green and still redden main, because nothing regenerates
the changelog on its behalf. Filed for the operator as a standing question rather
than fixed here - out of scope for a red-main hotfix.