docs: 2026-06-02 rule-catalogue extensions (#414, #415, #422) (#424)

## Summary

Reflect recent rule-catalogue PRs in CHANGELOG and STATE.a2ml:

- **#414** — scoped MPL-2.0 carve-outs for upstream-derived submodules
- **#415** — SC-010 transitive_dep_drift flipped to auto_fixable:false
(manual-only)
- **#422** — WF024 chapel_runs_on_drift auto-fix + WF025
cron_schedule_drift + BH008 inherited_main_debt

## Files

- CHANGELOG.md — Unreleased entries
- .machine_readable/6a2/STATE.a2ml — session-history entry

## Test plan

- [x] Markdown renders
- [x] No license/SPDX content touched

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -84,6 +84,13 @@ actions = [
 ]
 
 [session-history]
+# 2026-06-02: PR #422 — WorkflowAudit WF024 chapel_runs_on_drift auto-fix
+#             (Chapel jobs missing ubuntu-22.04 pin) + WF025 cron_schedule_drift
+#             + BaselineHealth BH008 inherited_main_debt (workflows on red main
+#             before a branch is cut). PR #415 — flipped SC-010
+#             transitive_dep_drift to auto_fixable:false (manual review only).
+#             PR #414 — scoped MPL-2.0 carve-outs for upstream-derived
+#             submodules (license carve-out documentation).
 # 2026-05-31: Cohort #333 + Group-B CI/CD detection rules. Merged
 #             duplicate_cron_schedule (#362), WF021 concurrency_missing_readonly
 #             (#365), WF022 unanchored_heading_regex (#360). Reverted a duplicate

CHANGELOG.md

@@ -20,6 +20,7 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- feat(rules): WorkflowAudit WF024 `chapel_runs_on_drift` auto-fix + WF025 `cron_schedule_drift` + BaselineHealth BH008 `inherited_main_debt` (#422)
 - feat(rules): StructuralDrift SD021 `workflow_branch_refs` — flag workflow trigger branches that aren't real repo branches (#363)
 - feat(rules): WorkflowAudit WF023 `stale_continue_on_error` — flag continue-on-error masks gated on a now-closed issue (#364)
 - feat(rules): HonestCompletion `stale_issue_refs` — flag comments referencing closed/merged issues (#366)
@@ -39,6 +40,14 @@ this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- fix(rules): SC-010 `transitive_dep_drift` set `auto_fixable: false` — manual-only review (#415)
+
+### Changed
+
+- chore(license): scoped MPL-2.0 carve-outs for upstream-derived submodules (#414)
+
+### Fixed
+
 - fix(supply_chain): replace exponential Levenshtein with iterative DP (#329)
 - fix(code_scanning_alerts): break CSA001 self-referential echo loop (#328)
 - fix(self): clear 113 dogfood findings — exempt fixtures + harden 9 prod unwraps (#324)