docs: add CHANGELOG with daemon-startup hardening release notes

Introduces CHANGELOG.md (Keep a Changelog style, Unreleased section) covering this
batch, with F8's breaking change — remote plaintext RPC now refused by default —
called out front and center along with the rpctls=1 / rpcallowplaintext=1 recovery
steps. Also records the Security / Fixed / Added entries for F1-F7. Updates the
tracking doc's status to reflect the completed release-notes + i18n back-fill and the
remaining pre-release items (F1/F2 manual repros, CJK subset-font rebuild).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/daemon-startup-hardening.md

@@ -17,9 +17,16 @@ Status legend: ☐ not started · ◐ in progress · ☑ landed & verified
 
 **Status: all 8 landed & verified** (build-clean, `ctest` green after each) across four commits on
 `dev` — lifecycle cluster (F1/F2/F4), filesystem+params cluster (F7/F6/F5), F3, and F8. Six new
-pure-helper unit tests added. Still owed before release: the F1/F2 manual repros (`kill -SEGV` /
-non-executable binary — not unit-testable), the deferred `res/lang/*.json` i18n back-fill (one
-`add_missing_translations.py` run), and **release notes for F8's breaking default flip**.
+pure-helper unit tests added.
+
+**Wrap-up done:** release notes added (`CHANGELOG.md`, F8 breaking change front and center); i18n
+back-fill applied additively to `res/lang/*.json` (42 keys — all 6 for es/de/fr/pt/ru; 6 zh/ja/ko
+entries whose glyphs aren't in the current `NotoSansCJK-Subset.ttf` were left on English fallback
+rather than render as tofu).
+
+**Still owed before release:** the F1/F2 manual repros (`kill -SEGV` / non-executable binary — not
+unit-testable), and a **CJK subset-font rebuild** (`scripts/build_cjk_subset.py`, needs the Noto
+CJK source font) to cover those 6 deferred zh/ja/ko strings.
 
 ---