docs: Route CoC reports to private reporting; Tidy CHANGELOG

[AllanOps]

What this changes

Type of change

• New trick
• Fix / sharpening of an existing trick
• Docs / CI / tooling

Checklist

• Commit messages follow Conventional Commits (feat:, fix:, docs:…)
• Ran node scripts/validate-repo.mjs and node scripts/scan-content.mjs locally — both passed
• Content follows the trap-vs-fix format in CONTRIBUTING.md

Security checklist (required for any change under skills/)

• No new external URLs — or they're added to scripts/url-allowlist.json with a justification
• No invisible / bidirectional Unicode or encoded blobs
• Nothing that would direct an agent to fetch or run remote content, or to read or transmit environment variables or secrets