docs(rook-ceph): update CephX rotation changelog with PR #1398 and Rook v1.20.6 status

[Aviator-Coding]

Intent

Update CephX rotation changelog entry: replace PR #TBD placeholder with #1398, and update Rook v1.20.6 prerequisite from pending gate to satisfied (Rook v1.20.6 deployed via PR #1397)

What Changed

• Updated the CephX daemon key rotation entry in docs/ceph-cluster-changelog.md to reference PR feat(rook-ceph): rotate daemon cephx keys onto aes256k #1398 in place of the #TBD placeholder, and reworded the section heading from "gated on Rook v1.20.6" to "Rook v1.20.6 live".
• Updated the entry's "Prerequisite" field to state Rook >= 1.20.5 is now Satisfied, noting the cluster was upgraded to Rook v1.20.6 via PR fix(container): update rook-ceph group ( v1.20.4 -> v1.20.6 ) #1397, and removed the now-obsolete merge-order warning text about the cluster still being on v1.20.4.
• Updated the "Current State" table's Rook version row from v1.20.4 to v1.20.6, with a pointer to the 2026-08-23 CephX rotation entry.

Risk Assessment

✅ Low: Docs-only, two-line edit to a changelog entry; both new claims (PR #1398 rotation, Rook v1.20.6 via PR #1397) are independently verified as merged via gh pr view and the live ocirepository.yaml tag, and the edit satisfies the stated intent exactly with no functional code touched.

Testing

This is a prose-only edit to docs/ceph-cluster-changelog.md (2 lines changed, no code); I validated it the way an end-user maintainer would, by checking the new claims against ground truth rather than just eyeballing the diff. GitHub confirms PR #1397 ("update rook-ceph group v1.20.4 -> v1.20.6") and PR #1398 ("rotate daemon cephx keys onto aes256k") are both merged, with #1398's merge commit exactly matching this branch's base commit - so the placeholder replacement and the "Prerequisite: Satisfied" wording are both accurate. The live GitOps config (operator/cluster ocirepository.yaml) confirms Rook is indeed pinned to v1.20.6, backing the "Rook v1.20.6 live" claim. The edited markdown table's row structure remains intact. No test failures, no code to unit test, and the worktree is clean with no stray artifacts.

Evidence: gh pr view 1397/1398 confirming merge state matches changelog claims

PR #1397: MERGED, "fix(container): update rook-ceph group ( v1.20.4 -> v1.20.6 )", mergeCommit=915bd59f91f9e29a65e76c1db3684abad2660243, mergedAt=2026-08-23T12:14:11Z
PR #1398: MERGED, "feat(rook-ceph): rotate daemon cephx keys onto aes256k", mergeCommit=44e987481dd3cd62c25c0b282a86f2d7e9381d9b, mergedAt=2026-08-23T13:01:55Z

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• git diff 44e98748..3878b2c4 -- docs/ceph-cluster-changelog.md (confirmed only the 2 targeted lines changed)
• gh pr view 1397 -R Aviator-Coding/home-ops --json number,title,state,mergedAt,mergeCommit (MERGED, v1.20.4->v1.20.6, matches claim)
• gh pr view 1398 -R Aviator-Coding/home-ops --json number,title,state,mergedAt,mergeCommit (MERGED, merge commit == branch base commit 44e98748, matches claim)
• grep for tag: v1.20.6 in kubernetes/apps/rook-ceph/rook-ceph/{operator,cluster}/ocirepository.yaml (confirms Rook v1.20.6 is actually live in GitOps config)
• awk pipe-count check on docs/ceph-cluster-changelog.md lines 86-96 (confirms markdown table structure/row field-count unbroken after edit)
• git status --porcelain (worktree clean, no stray artifacts)

⏭️ **Document** - skipped

• ℹ️ docs/ceph/toolbox.md:33 - docs/ceph/toolbox.md (lines 33 and 41) and the code comment in kubernetes/apps/rook-ceph/rook-ceph/operator/csi-driver-rbac.yaml (line 11) still say the Rook chart is 'v1.20.4', including a rook/ceph:v1.20.4 toolbox debug-image example. The live tag is v1.20.6 (confirmed via ocirepository.yaml and the baseline table just corrected in docs/ceph-cluster-changelog.md). This staleness predates this branch - it was introduced by an earlier, already-merged Renovate bump commit that never touched these two files - and is unrelated to this change's PR-number/prerequisite wording fix, so it was left alone here to keep this pass scoped. Worth a small follow-up to sync these version references (and confirm the toolbox debug-image guidance still holds at v1.20.6).

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.