v0.2.26

Added

• Added a human-reviewed release-notes pipeline: /draft-release-notes drafts
  candidate changelog text for operator review, scripts/prep-release.sh
  promotes reviewed [Unreleased] notes to a versioned section, and GitHub
  Releases now publish the committed CHANGELOG.md section through
  --notes-file.
• Added changelog discipline for pull requests, including an advisory workflow
  warning and PR-template checkbox so release-relevant changes keep
  [Unreleased] current before release prep.
• Added historical v0.2 changelog backfill tooling: a reviewed packet,
  structural/git-range verifier, landing helper, and release-notes proof
  verifier for the first future tag cut through the new pipeline.

Changed

• Hardened privileged E2E routing so real-KVM jobs require broker-issued runner
  labels and cannot silently fall back to the persistent kvm runner.
• Updated privileged E2E target-state docs and public freshness proof handling
  for post-publication release evidence.