chore(changelog): fold [Unreleased] into [1.5.2] + strip internal-reference Tracking trailers [skip-runtime-e2e] (#78)

## Skip-runtime-e2e justification

CHANGELOG-only edit — pure release-notes hygiene, no code change, no
runtime contract touched.

## Summary

- Folded the [Unreleased] section into the topmost release-line section
  so the topmost release-line in CHANGELOG matches the manifest version.
  Pre-fold, [Unreleased] held post-current-version work that would have
  made the section inconsistent against `plugin.json` / `package.json`.
  Expanded the topmost-section title to reflect the added scope.
- Empty [Unreleased] header retained per Keep-a-Changelog convention.
- Stripped `### Tracking` trailers (with internal issue links) from
  every section in scope — internal-team references are not
  customer-facing release-notes content.

No code or behavior changes.

Signed-off-by: Saurabh Jain <saurabh.jain@getaxonflow.com>

Author: saurabhjain1592

CHANGELOG.md

@@ -2,6 +2,8 @@
 
 ## [Unreleased]
 
+## [1.5.2] - 2026-05-20 — Cross-plugin cooldown env override + Cache-layout doc fix + `org_id` in telemetry heartbeat
+
 ### Added
 
 - **`org_id` field in the telemetry heartbeat body.** Brings the Codex
@@ -21,25 +23,16 @@
 
 ### Changed
 
-- **`scripts/telemetry-ping.sh` header comment** softened from "Anonymous
-  telemetry heartbeat" to "Telemetry heartbeat" alongside the `org_id`
-  addition — the operator-supplied `ORG_ID` is not anonymized.
-
-### Tracking
-
-- [#2277](https://github.com/getaxonflow/axonflow-enterprise/issues/2277)
-
-## [1.5.2] - 2026-05-20 — Cross-plugin alignment: `AXONFLOW_AUTH_FAILURE_COOLDOWN_SECONDS` env override + Cache-layout doc fix
-
-### Changed
-
 - **401 auth-failure cooldown is now overridable via
   `AXONFLOW_AUTH_FAILURE_COOLDOWN_SECONDS`** (canonical name shared
   with the cursor and claude plugins). Default behavior is unchanged
   — unset = 300s. Malformed values (non-integer, zero, negative) fall
   back to 300s so a typo in the env var can't silently disable the
   back-off. Useful for testing and tuning; production deployments
   continue to use the default.
+- **`scripts/telemetry-ping.sh` header comment** softened from "Anonymous
+  telemetry heartbeat" to "Telemetry heartbeat" alongside the `org_id`
+  addition — the operator-supplied `ORG_ID` is not anonymized.
 
 ### Fixed
 
@@ -69,10 +62,6 @@
   stderr nudge naming the failure and pointing at
   https://getaxonflow.com/dashboard for credential refresh.
 
-### Tracking
-
-- [#2275](https://github.com/getaxonflow/axonflow-enterprise/issues/2275)
-
 ## [1.5.0] - 2026-05-19 — Terminology: `tenant_id` → `client_id` in user-facing output
 
 ### Changed
@@ -108,10 +97,6 @@
   that Stripe Checkout's custom field is still labeled "AxonFlow
   tenant ID" until that form is updated separately.
 
-### Tracking
-
-- [#2230](https://github.com/getaxonflow/axonflow-enterprise/issues/2230)
-
 ## [1.4.0] - 2026-05-09 — Decision History API + policy_version recorded on every decision + telemetry simplification
 
 ### Added