docs: cover engineering evolution in Unreleased changelog

[TheAmericanMaker]

Summary

• Add Unreleased entries for the E01–E11 engineering record, planning, proof, gating, MCP, Traverse, and traceability work, plus the later feat: MCP acceptance adapter (request_acceptance via client elicitation) #445–feat: attempt lifecycle on the MCP surface (start_attempt, capture_candidate, record_review) #447 adapters and attempt lifecycle.
• Record the Windows lock fix, test isolation, CI gate, and removed tracked node_modules symlink. Update two stale statements in existing entries after later merges.
• State the shipped trust limits: the verified acceptance integration registry is empty; E11 uses synthetic fixtures; the live-host F01 pilot and human acceptance have not happened.

This fills the changelog gap before the next release decision. Refs #409. The release heading and package version are unchanged.

Coverage of v0.26.0..origin/main

All merged runtime, template, CI, and test-behavior changes have an Unreleased entry. #411 was already covered by #393–#395; #443 by #185 (now also cited by PR number).

Deliberately omitted from Unreleased as documentation-only project history rather than a shipped behavior change: #397 (self-audit closeout), #410 (engineering vision and roadmap), #413 (pilot preregistration and rubric), #416 (host feasibility report), #419 (E01 status and E12 handoff), #424 (B01 pilot report), and #430 (FreeAgent evidence naming). Their implementation or behavior changes, where any, are covered by the entries for the respective later PRs.

Verification

• Before the edit, a local Unreleased reference check exited 1 and listed 17 missing feature/fix PR references: feat: freeze the v1 engineering record and approval contract (E01) #414, feat: bind records to stable input and candidate snapshots (E03) #420, feat: persist isolated changes and immutable attempts (E02) #426, feat: plan a repository-local change without a library (E04) #431–Expose the engineering record over MCP without exposing execution (E07) #434, The supervised Traverse loop: decided from records, executed by the host (E08) #436, E09: slice-to-scenario traceability in planning artifacts #438–Fixture git commands see nothing of the developer's environment (#423) #442, fix: make stale lock ticket reaping single-winner on Windows #444–feat: attempt lifecycle on the MCP surface (start_attempt, capture_candidate, record_review) #447.
• After the edit, the same coverage check plus the previously covered PRs found 28/28 tracked feature/fix PR references; git diff --check passed.
• npm ci: exit 0; 137 packages installed.
• npm run build: exit 0.
• npm test: exit 0; 1,374 tests passed, 0 failed.

Linux only locally. Windows behavior relies on CI test-windows; required CI checks include test (22), test (24), and test-windows.

Current CI state

test-windows, both CodeQL analyze jobs, and CodeQL passed. test (22) and test (24) failed before build/tests at npm audit --omit=dev --audit-level=high: the locked production dependency tree reports high advisories for brace-expansion and undici. The lockfile is byte-identical to origin/main; this PR changes only CHANGELOG.md. I reproduced the audit failure locally. Updating dependencies is a separate follow-up for the maintainer; this draft is not CI green.