docs: add CHANGELOG entry for 1.17.0 — inline-DB-mutation family

Documents:
- The six new inline-db-mutation-* rules and what each blocks.
- Shared bypass marker `db-mutation-rule`.
- New schema field `disable_if_repo_file` + the per-repo sentinel
  `.no-make-no-mistakes-db-mutation`.
- The "versioned scripts: yes; inline one-shots: no" exemption pattern.
- Final stats: 38 rules total (was 32), 262 / 262 tests pass
  (210 baseline + 52 new).

Author: lapc506

CHANGELOG.md

@@ -18,6 +18,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.17.0] - 2026-05-21
+
+### Added
+- **Six new `inline-db-mutation-*` rules extending the scripts-not-DB
+  discipline (`feedback_scripts_not_db.md`) beyond Moodle/SSH to every DB
+  CLI.** The pre-existing `ssh-db-mutation` rule only caught
+  `gcloud compute ssh ... --command=` with Moodle-flavoured payloads
+  (`mdl_`, `scorm_`, `php -r`). This release blocks inline mutations
+  across the full surface a developer is likely to reach for:
+  - `inline-db-mutation-mysql` — `mysql -e "UPDATE/DELETE/..."`,
+    `mysql ... < file.sql`, `mysqldump ... | mysql ...`.
+  - `inline-db-mutation-psql` — `psql -c "UPDATE/INSERT/ALTER/CREATE/
+    GRANT/REVOKE/REPLACE/RENAME"` and `pg_restore`. Complements the
+    existing `destructive-db-ops` rule (which already covers DROP /
+    TRUNCATE / DELETE FROM via psql).
+  - `inline-db-mutation-sqlite` — `sqlite3 path "<mutation>"`.
+  - `inline-db-mutation-mongo` — `mongo|mongosh --eval "db.x.<mutating
+    method>(...)"` and `mongorestore`.
+  - `inline-db-mutation-redis` — `redis-cli SET / DEL / FLUSHDB /
+    FLUSHALL / HSET / HDEL / SADD / SREM / LPUSH / RPUSH / ZADD / ZREM /
+    EXPIRE / RENAME / MSET / SETEX / SETNX / INCR / DECR / COPY / MOVE /
+    UNLINK / RESTORE / EVAL`.
+  - `inline-db-mutation-gcloud-sql` — `gcloud sql import sql|csv|bak` and
+    `gcloud sql export sql|csv|bak` (export blocked because PII-bearing
+    prod exports also belong in versioned scripts).
+- **Shared bypass marker `db-mutation-rule`** across all six rules. A single
+  consistent escape token keeps the muscle memory cheap.
+- **Per-repo escape hatch via `disable_if_repo_file`.** New optional rule
+  schema field: when present, the rule no-ops if a sentinel file with
+  that exact name exists in the cwd. The inline-DB-mutation family ships
+  with `disable_if_repo_file: .no-make-no-mistakes-db-mutation`, so a
+  repo whose entire job is inline DB work can opt out with a one-liner
+  (`touch .no-make-no-mistakes-db-mutation`). Hardened path validation
+  (filename must match `^[a-zA-Z0-9._-]+$`, cannot be `.` / `..`) prevents
+  the runtime lookup from escaping the cwd.
+
+### Changed
+- `hooks/lib/eval-rule.sh` honours `disable_if_repo_file` between the
+  bypass-marker check and the match-condition loop.
+- `scripts/build-rules.mjs` validates the new field's shape at build time
+  (same kebab-validation defense-in-depth as `bypass_marker`).
+- `hooks/rules/README.md` documents the new field and the per-repo escape
+  hatch pattern. README.md "Hooks" section now lists the six rules and
+  the bypass marker.
+
+### Notes
+- 38 rules total (was 32). 262 / 262 tests pass (210 baseline + 52 new).
+- SELECT-only reads (`SELECT`, `SHOW`, `DESCRIBE`, `EXPLAIN`, `KEYS`,
+  `GET`, `.find`, `.aggregate`, ...) remain allowed inline. The rules
+  only fire on the mutation keyword set per CLI tool.
+- Commands that START with `./scripts/`, `bash scripts/`, `./bin/`, or
+  `bash bin/` are exempted via `not_pattern` — the principle is
+  "versioned scripts: yes; inline one-shots: no". When a wrapper script
+  is the invocation surface, the sensitive payload lives in git history.
+- Memory ref: `feedback_scripts_not_db.md` (already existed for the
+  Moodle-flavoured `ssh-db-mutation` rule; this release simply expands
+  the enforcement surface).
+
 ## [1.16.0] - 2026-05-20
 
 ### Added