docs,test: fill the unreleased changelog and guard it against future lag

[joshua-temple]

The CHANGELOG [Unreleased] section has lagged merged user-facing fixes across several audit passes. This fills it and adds a durable guard so it cannot silently lag again.

• docs: add the four user-facing fixes merged after v0.16.1 that were not yet captured (promote component-state preservation, orchestrate component-state overlay, output-key collision rejection, simulate rollback deploy-result gate).
• test: a guard (TestChangelog_UnreleasedCoversUserFacingCommits) that enumerates feat/fix/perf/breaking commits since the last release tag using the same conventional-commit parser the release notes use, and fails when [Unreleased] does not cover them. It skips cleanly on shallow/tagless checkouts; the two go-test CI jobs now fetch full history so it enforces in CI.
• CONTRIBUTING: codified the update-the-changelog-with-every-user-facing-change rule.

Verification: build/test green, guard proven (fails when [Unreleased] emptied while user-facing commits exist, passes when filled), README-examples + docs-version-sync + docs build all green.