docs: add a CHANGELOG — the release archives have been shipping without one

[0xmanhnv]

Context: the agent has never been released

86 commits on main, zero tags. Both release.yml and docker-publish.yml
are gated on v*, so neither has ever run. The openctemio/agent:demo-ci-fixed
image in use today was built by hand.

Before anyone pushes the first tag, I ran the pipeline against a throwaway one
to find out whether it works.

It works

Check	Result
go build ./..., go vet ./...	exit 0
go test ./...	exit 0
goreleaser check	config validated
goreleaser release --snapshot --skip=publish	exit 0, 82s
archives produced	linux/amd64, linux/arm64, darwin/arm64 (.tar.gz + .zip) + checksums
docker build	exit 0

So a v0.1.0 tag would produce a real release. That is worth knowing before
pushing one, given this repo's history of workflows that had never actually run.

The one thing it reported

Six times, once per archive:

• no files matched                               glob=CHANGELOG*

.goreleaser.yaml asks for README.md, LICENSE* and CHANGELOG* in every
archive. The first two exist. The third never has:

$ tar -tzf dist/agent_..._linux_amd64.tar.gz
LICENSE
README.md
agent

The component customers install would ship its first release with no record
of what is in it.

What this adds

The record. Most of the 86 commits' value is security work, so that is where the
detail is:

• two-tier SSRF guard on scanner targets, with a hard tier no flag can open
  (metadata endpoints, loopback, CGNAT, multicast, IPv6 link-local) and a soft
  RFC1918 tier behind AGENT_ALLOW_PRIVATE_TARGETS
• dangerousToolFlags deny-list, completeness CI-enforced
• RFC-007 §8 R1 runner target-guard
• ExtraArgs validation and bounds checking
• SHA-256 verification of gitleaks/trivy/nuclei/semgrep binaries at image build
• three Go toolchain bumps for stdlib CVEs, now on go 1.26
• the weekly image scan that was reporting green without scanning

plus the features: RFC-011 safe-check executor, RFC-007 Tenable runner mode,
risk-aware CI gate, RFC-008 PR-scoped baseline-diff, RFC-014 Phase 2 key
auto-renewal, RFC-001 asset-name normalisation.

Verified

Re-ran the pipeline with this file present — warning gone, and:

$ tar -tzf dist/agent_..._linux_amd64.tar.gz
CHANGELOG.md
LICENSE
README.md
agent