Apply changelog updates

Author: bhollis

docs/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 * Reject Bungie OAuth callbacks whose state parameter is missing when no state was stored, closing a login CSRF where an attacker-supplied code could be exchanged.
 * The Loadout Optimizer is up to 2x faster when activity mods are locked.
+* Loadout Optimizer no longer waits for vendors to load.
 
 ## 8.133.0 <span class="changelog-date">(2026-07-12)</span>