docs: write the 0.4 changelog in the categorized 0.3 format

Reference-style links put the [n]: definitions at the file bottom,
outside the per-version section that publish.yml extracts — so the GitHub
release notes rendered dangling [text][n] references. Use the same
Added/Changed/Fixed/Security prose format as 0.3, which is self-contained
and needs no link definitions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: dfa1

CHANGELOG.md

@@ -1,37 +1,45 @@
 # Changelog
 
-Notable changes, one line each — follow the link to the commit for detail.
-Versions are `v*` git tags, which trigger publication to Maven Central.
+All notable changes to this project are documented here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/); versions are released as `v*`
+git tags, which trigger publication to Maven Central.
 
 ## [0.4]
 
-- [Add `Zstd.versionNumber()` for programmatic version checks][16]
-- [Fix a native context leak when a stream constructor fails mid-setup][13]
-- [`ZstdSkippableContent` is a defensively-copied, value-equal record][21]
-- [Fail fast with a named `NullPointerException` on null arguments; document stream / digested-dictionary thread-safety][22]
-- [Harden the native loader (owner-only temp dir) and pin CI actions to a commit SHA][20]
+### Added
+- `Zstd.versionNumber()` — the linked zstd version as a single integer
+  (`MAJOR * 10000 + MINOR * 100 + PATCH`, e.g. `10507` for `1.5.7`), for
+  programmatic version checks alongside `version()`.
+
+### Changed
+- `ZstdSkippableContent` is now a true immutable value: it defensively copies its
+  bytes on the way in and out, and compares by content
+  (`equals` / `hashCode` / `toString` over the payload, not array identity).
+- Public methods fail fast with a named `NullPointerException` on null `byte[]`,
+  dictionary, or sample arguments, instead of an opaque failure deep in native
+  code. Streams are documented as not thread-safe; digested dictionaries
+  (`ZstdCompressDict` / `ZstdDecompressDict`) as immutable and safe to share.
+
+### Fixed
+- A streaming wrapper that failed partway through construction (e.g. an invalid
+  parameter or dictionary) leaked the native context. The context is now freed
+  on every constructor error path.
+
+### Security
+- The bundled library is extracted into a directory created owner-only
+  (`rwx------`) atomically at creation, not just by default. The third-party
+  `setup-zig` CI action is pinned to a full commit SHA.
 
 ## [0.3]
 
-- [`zstd-platform` is now an empty convenience jar (not a `pom`)][9]
-- [Bundled-only native loader; fix Sonar vulnerability + bug][8]
-- [`ByteBuffer` interop + pledged-size zero-copy decode][6]
+- [`zstd-platform` is now an empty convenience jar (not a `pom`)](https://github.com/dfa1/zstd-java/commit/ba5593a)
+- [Bundled-only native loader; fix Sonar vulnerability + bug](https://github.com/dfa1/zstd-java/commit/8d0ea6a)
+- [`ByteBuffer` interop + pledged-size zero-copy decode](https://github.com/dfa1/zstd-java/commit/8bfe272)
 
 ## [0.2]
 
-- [`zstd-platform` aggregator; off-heap `MemorySegment` dictionary constructors][v0.2]
+- [`zstd-platform` aggregator; off-heap `MemorySegment` dictionary constructors](https://github.com/dfa1/zstd-java/releases/tag/v0.2)
 
 ## [0.1]
 
-- [First release: JDK 25 FFM bindings for Zstandard 1.5.7, built with `zig cc`][v0.1]
-
-[16]: https://github.com/dfa1/zstd-java/commit/e6a3537
-[13]: https://github.com/dfa1/zstd-java/commit/49e01b4
-[21]: https://github.com/dfa1/zstd-java/commit/a5f4aa0
-[22]: https://github.com/dfa1/zstd-java/commit/7dbad8e
-[20]: https://github.com/dfa1/zstd-java/commit/c9929b9
-[9]: https://github.com/dfa1/zstd-java/commit/ba5593a
-[8]: https://github.com/dfa1/zstd-java/commit/8d0ea6a
-[6]: https://github.com/dfa1/zstd-java/commit/8bfe272
-[v0.2]: https://github.com/dfa1/zstd-java/releases/tag/v0.2
-[v0.1]: https://github.com/dfa1/zstd-java/releases/tag/v0.1
+- [First release: JDK 25 FFM bindings for Zstandard 1.5.7, built with `zig cc`](https://github.com/dfa1/zstd-java/releases/tag/v0.1)