docs: release-readiness sweep — spec + populate changelog, refresh guides, future-proof upgrade test

[remyluslosius]

Release-readiness docs + changelog sweep

Brings docs, the changelog, and the upgrade postscripts up to date for the
release, and specs the changelog format so entries stay human-readable.

Changelog is now specced and populated

• New specs/release/changelog.spec.yaml (release-changelog): every entry is
  a user-facing sentence (>=5 words, no commit-subject prefix), Keep a Changelog
  categories, dated version sections, no emoji. Enforced by
  packaging/tests/changelog_test.go (source-inspection, AC-01..05), scoped to
  the actively-edited [Unreleased] section so history is grandfathered.
• Registered in specter.yaml (108 specs total now).
• Populated [Unreleased] with the post-rc.7 work in that style: Settings
  activation (users, notifications, security/SSO), per-host SSH auth/sudo
  learning, one-command safe upgrade, airgap + fresh-install fixes, and the
  pre-release security-hardening batch (fix(security): pre-release hardening batch — 8 SDD-specced fixes #584).

Docs refreshed to match main

• docs/guides/SECURITY_HARDENING.md: removed the "not yet implemented"
  rate-limit/headers callout (those shipped in fix(security): pre-release hardening batch — 8 SDD-specced fixes #584). Documents auth rate
  limiting, CSRF double-submit, and security headers as live; notes always-on
  breach-password screening; adds an outbound-SSH persistent known-hosts
  subsection (migration 0036). Version line to the 0.2.0 rc series.
• docs/engineering/install_guide.md: fixed the stale DEB version example
  (rc.5 -> rc.7) and added an Upgrading section documenting the
  one-command auto-migrate + pre-upgrade pg_dump + fail-safe flow and
  /etc/openwatch/upgrade.conf.

Upgrade postscripts: verified and made future-proof

• The RPM/DEB upgrade scriptlets, openwatch-upgrade.sh, and dbbackup already
  match the release-upgrade spec; the Go gates (upgrade_test.go AC-01..07,
  dbbackup tests, the full packaging/tests build suite) pass.
• Rewrote the container integration test (upgrade-container-test.sh +
  run-upgrade-container-test.sh) to stop hardcoding migration 34->35 and the
  host_connection_profile table — it broke the moment migration 0036 landed
  and would re-break on every new migration. The host driver now derives the
  head migration's goose version_id and its -- +goose Down SQL and passes them
  in; the test reverses exactly the head migration and asserts a generic
  prior->head advance. Also pinned the driver to the host RPM arch (a leftover
  cross-built arm64 RPM in dist/ was colliding in the container).
• Validated end-to-end: a real rpm -U in rockylinux:9 ran the %post
  helper ($1=2), stopped the service, took a pg_dump restore point, applied
  0036 (35 -> 36), and restarted. RESULT: PASS.

Note on CLAUDE.md

CLAUDE.md was also refreshed locally (spec count 97 -> 108; current Go security
controls), but it is intentionally gitignored (do not commit, commit
7a73353), so that change stays local and is not part of this PR.

Not included

The three still-open PRs (#580 distro matrix, #582 SPA caching, #583 auth
redirect) are not yet on main, so they are not in [Unreleased]; each should
add its own changelog line on merge (now gated by release-changelog).

🤖 Generated with Claude Code