cppa-cursor-browser: backfill the changelog with the six merged Week 30 PRs

[clean6378-max-it]

Sprint Item

is-9 of 13 — Task — Wednesday PR 3 of 4 (docs-only)

Block Relations

Blocked by	is-7 (soft) — if the cache fix merges first, its entry goes in the same section
Blocks	is-10 (hard) — the Release notes are copied from the [0.2.1] section, so it must exist first
Repo/day	Independent of is-1–is-6 and is-11–is-13

Calendar Day

Wednesday, July 29, 2026 (PR 3 of 4 — docs-only)

Planned Effort

1 story point (Task) — sprint item is-9

Problem

CHANGELOG.md has an empty [Unreleased] section (lines 8-9) and its latest release entry is [0.2.0] - 2026-07-17.

Six PRs merged after the v0.2.0 tag during the Week 30 browser-security sweep are absent from the changelog:

PR	What it did
#145	highlight.js SRI pin
#146	structured {error, code} bodies
#147	CSP header with nonce
#148	CI benchmark gate exclusion
#150	HTTP 409 on multi-worker set-workspace
#151	Playwright XSS tests for renderMarkdownSafe

All six are on master at HEAD and undocumented for the upcoming v0.2.1.

Goal

One docs-only PR adding an accurate [0.2.1] section so the Release notes in item is-10 can be copied straight out of it.

Scope

Part A — confirm the list

• git log v0.2.0..HEAD --oneline to confirm the six PRs and draw the one-line descriptions from their commit messages.

Part B — write the section

• Add ## [0.2.1] - YYYY-MM-DD with Added, Changed and Fixed subsections. Suggested grouping:
  • Added — fix: pin highlight.js script and theme with SRI #145 and feat: add Content-Security-Policy header with nonce for inline bootstrap #147 (security hardening), playwright xss tests for renderMarkdownSafe #151 (test coverage)
  • Fixed / Changed — feat: structured {error, code} bodies across all api blueprints #146 and fix: return 409 from set-workspace when multiple WSGI workers are in use #150 (API behaviour)
  • Changed — ci: exclude composers-50 export bench from regression gate #148 (CI)
• Include item is-7's summary-cache fix if it has merged by then — it ships in the same release.

Part C — housekeeping

• Clear the [Unreleased] section.
• Update the compare links at the bottom.
• Match the style of the existing [0.2.0] section (lines 10-46).

Out of scope

• The pyproject.toml version bump — that belongs to item is-10 (release/v0.2.1). Keeping them apart means this PR can be reviewed and merged while the release commit waits on green CI.

Acceptance Criteria

• CHANGELOG.md contains a new ## [0.2.1] - YYYY-MM-DD section with Added, Changed and Fixed subsections.
• All six PRs are referenced with accurate one-line descriptions drawn from their commit messages.
• The [Unreleased] section is cleared and the compare links at the bottom are updated.
• No version bump in this PR.
• PR approved by at least 1 reviewer.

Verification

# from the cppa-cursor-browser checkout root
git log v0.2.0..HEAD --oneline

• Cross-check every changelog bullet against a real commit in that range; no invented entries, no missing PRs.
• Confirm git diff --stat touches only CHANGELOG.md.
• Confirm the compare links at the footer resolve to the right tag range.

References

• Sprint: Week 31 (Jul 27–31, 2026) — Chen item is-9 (1 pt, Task)
• Week 31 weekly plan — cppa-cursor-browser
• Week 31 issue descriptions — cppa-cursor-browser, changelog backfill
• Eval finding: n/a
• Files: CHANGELOG.md:8-9,10-46; .github/workflows/tests.yml; app.py; static/js/app.js
• Companion: Wednesday is-7 summary-cache lock, is-8 release workflow, is-10 v0.2.1 tag
• Week 30 PRs covered: fix: pin highlight.js script and theme with SRI #145, feat: structured {error, code} bodies across all api blueprints #146, feat: add Content-Security-Policy header with nonce for inline bootstrap #147, ci: exclude composers-50 export bench from regression gate #148, fix: return 409 from set-workspace when multiple WSGI workers are in use #150, playwright xss tests for renderMarkdownSafe #151