docs(changelog): fold Unreleased into 0.7.0 again, and record the drift guards

[rainmanjam]

Second time today, and that's the finding rather than the fix.

[Unreleased] sits above [0.7.0], so under Keep a Changelog its contents are newer than the release below them — and every PR correctly appended there. Nothing folds it forward, so the gap reopens after each merge and is only ever caught by somebody reading the file.

What was stranded

Nine entries that a tag would have silently omitted:

From
#366	all seven security fixes
#365	the VOD audio mix UI, and the EXPERIMENTAL convention

Plus #367 had no entry at all — zero mentions of the ten recovered drift guards.

Why this isn't cosmetic

GHSA-7jqx points at these release notes. The fix for its worst defect — 0.7.0's own seal-at-rest migration leaving plaintext stream keys legible in the WAL, which is true on every upgraded install and needs no attacker — was in a section the tag would not have included.

An operator following the advisory to the notes would not have found it.

The #367 entry

Written to say what actually justifies those ten guards: not that they pass, but that each was watched to fail against the defect it names. It also records the two real defects found in the recovered code before it landed — the comment-defeat, where deleting the feature and leaving its text in a // was: … comment kept the test green, and the unguarded strings.Index that turned a rename into a slice-bounds panic instead of a readable message.

And it records what was not fixed: the two internal/oauth guards remain comment-defeatable, because that package has no comment stripper and copying a 40-line helper between packages is the wrong repair.

Verification — the prose is moved, not retyped

old lines dropped:               0
0.6.0-and-older byte-identical:  True
[Unreleased]:                    'Nothing yet.'
0.7.0 entries:                   90  (was 80)
malformed links:                 0
conflict markers:                0

Worth fixing properly

This fold belongs in the release procedure, not in review. Twice in one day is a process gap, not two mistakes — the natural home is a check that fails a release build when [Unreleased] is non-empty, which this repo would call a guard and would expect to be able to fail.

https://claude.ai/code/session_01HeLrWaDmsNeeNSbHQfEofX

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR corrects release note drift by moving previously “stranded” [Unreleased] entries into the [0.7.0] section, ensuring the 0.7.0 tag’s notes include all intended changes and the newly added drift-guard work.

Changes:

• Resets the [Unreleased] section to “Nothing yet.”
• Moves the previously-unreleased entries back under ## [0.7.0] — 2026-08-14, including the “Ten UI-drift guards” testing note and other recovered content.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.