docs(release): prep v1.6.7 — transitive cleanup summary + migration table (PR-1.6.7) (#114)

Replaces the placeholder "Scope being assembled" intro on the
v1.6.7 — Planned CHANGELOG entry with the actual release summary:

- Three-paragraph prose summary (what shipped, zero-breaking status,
  migration). Mirrors the structure used for v1.6.6 — Planned at
  cut time (bfaa839 in PR-1.6.6).
- Migration table listing every transitive dependency consumers
  must now declare explicitly: kotlin-stdlib-jdk8, the relevant
  flexmark-ext-* modules, jackson-dataformat-yaml (YAML configs),
  jackson-module-jsonSchema, and commons-logging (rare — PDFBox
  routes via jcl-over-slf4j now, only callers who want the
  commons-logging API beyond SLF4J need an explicit declaration).
- Pulls in the japicmp verdict (semver PATCH, compatible bug fix)
  so reviewers see at a glance that the I3 NodeRegistry-non-final
  change is the only surface delta and it's a fix, not a break.

README release-status block + install snippets are intentionally
not touched here — the post-release-of-1.6.6 commit (6eb4694)
already flipped them to the right pre-1.6.7-cut shape (latest
stable v1.6.6 / in develop v1.6.7 / planned v1.7.0). The version
flip in the install snippets is part of cut-release.ps1 at
release time, not this PR.

Verification: ./mvnw test -pl .
-Dtest=VersionConsistencyGuardTest,DocumentationCoverageTest,DocumentationExamplesTest
- 22 tests, 0 failures. The full ./mvnw verify -P japicmp suite
was green at b4720c6 (the I3 merge) and this PR touches only
CHANGELOG prose.

Author: DemchaAV

CHANGELOG.md

@@ -5,10 +5,49 @@ follow semantic versioning; release dates are ISO 8601.
 
 ## v1.6.7 — Planned
 
-**Dependency cleanup cycle.** Scope being assembled — entries are
-filled in as work lands on `develop`. No breaking changes are
-planned; the next minor with new canonical DSL primitives is
-**v1.7.0** (see [ROADMAP.md](ROADMAP.md)).
+**Transitive dependency cleanup.** v1.6.7 narrows the runtime
+classpath GraphCompose imposes on consumers. The Kotlin standard
+library is gone (the codebase is Java-first; no production
+`.kt` sources exist), the `flexmark-all` aggregator is replaced
+with the three modules `MarkDownParser` actually references,
+`jackson-dataformat-yaml` is marked `<optional>true</optional>`
+(mirroring the existing `poi-ooxml` pattern — only consumers that
+load YAML configs through `ConfigLoader` need to pull it in),
+`jackson-module-jsonSchema` and the explicit `snakeyaml`
+declaration are dropped as unused, and `jcl-over-slf4j` is added
+explicitly so PDFBox's `commons-logging` call sites keep routing
+through SLF4J after the flexmark narrowing (the bridge was
+previously provided transitively via `flexmark-all`). The cycle
+also fixes a latent layout-cache staleness bug on
+`DocumentSession.registry().register(...)` (Track I3): the
+registry returned by `registry()` is now a session-owned wrapper
+that invalidates the layout cache on every mutation, matching the
+semantics of `DocumentSession.registerNodeDefinition(...)`.
+
+**Zero breaking public API changes.** The `japicmp` gate against
+the v1.6.6 baseline reports `semver PATCH, compatible bug fix` —
+the one surface delta is `NodeRegistry` becoming non-`final` so
+`DocumentSession` can install the auto-invalidating subclass
+described above. All existing call sites compile and run
+unchanged. The transitive cleanup is a runtime-classpath change,
+not a compile-surface change.
+
+**Migration from v1.6.6.** Consumers that relied on dependencies
+flowing transitively through GraphCompose must now declare them
+explicitly:
+
+| If you transitively depended on… | Add to your build |
+|---|---|
+| Kotlin stdlib via GraphCompose | `org.jetbrains.kotlin:kotlin-stdlib-jdk8` |
+| Flexmark extensions (tables, footnotes, gfm-strikethrough, …) | the relevant `com.vladsch.flexmark:flexmark-ext-*` modules |
+| YAML config loading through `ConfigLoader` | `com.fasterxml.jackson.dataformat:jackson-dataformat-yaml` |
+| `jackson-module-jsonSchema` | `com.fasterxml.jackson.module:jackson-module-jsonSchema` |
+| The `commons-logging` API beyond SLF4J routing | declare `commons-logging:commons-logging` explicitly (GraphCompose intentionally excludes it from PDFBox and bridges via `jcl-over-slf4j`) |
+
+No code changes are required for typical usage — pure-PDF
+consumers and JSON-only `ConfigLoader` callers carry on as before.
+The next minor with new canonical DSL primitives is **v1.7.0**
+(see [ROADMAP.md](ROADMAP.md)).
 
 ### Build