[Code Quality] Add CHANGELOG.md to track version history and structural changes

[github-actions]

The repository has no CHANGELOG.md, making it hard to track what changed between versions or understand the history of structural changes. The Daily Backlog Burner discussion #493 lists this as a medium-priority improvement, and the feedback comment reinforces the urgency:

"CHANGELOG.md (item #4) is worth doing sooner rather than later. Once modularization starts, we'll want a record of structural changes. Even a lightweight Keep a Changelog format would work."

This is especially timely as main.py modularization (#473) is about to begin — structural changes are exactly the kind of history a CHANGELOG captures.

Suggested Changes

1. Create CHANGELOG.md in the repository root using the [Keep a Changelog]((keepachangelog.com/redacted) format:

   • Add a ## [Unreleased] section as the rolling section for in-progress work
   • Document current state as ## [0.1.x] - 2026-02 baseline covering:
     • Added: pytest-benchmark in pyproject.toml, tests/test_benchmarks.py
     • Added: sanitize_for_log(), SSRF guards, CSV injection prevention
     • Added: 29+ dedicated test modules
     • Added: GitHub Actions CI (test, security, performance, QA workflows)
     • Changed: CLI formatting improvements (PR 🎨 Palette: Improve CLI output formatting #217)
     • Fixed: SECURITY.md version table updated to 0.1.x

2. Use semantic versioning — link to pyproject.toml version field as the source of truth

3. Establish a convention in CONTRIBUTING.md (or as a note in CHANGELOG.md) that contributors add entries under [Unreleased] with their PRs

Files Affected

• CHANGELOG.md (new file, repo root)
• Optionally: CONTRIBUTING.md — add a short note directing contributors to update CHANGELOG.md

Success Criteria

• ✅ CHANGELOG.md exists at repo root following Keep a Changelog format
• ✅ Contains [Unreleased] section and at least one versioned entry ([0.1.x])
• ✅ Covers key changes: benchmark addition, security hardening, CLI formatting, test coverage expansion
• ✅ Format consistent with [keepachangelog.com v1.1.0]((keepachangelog.com/redacted)

Source

Extracted from Daily Backlog Burner discussion #493 — "Add CHANGELOG.md" listed under 🟡 Medium Priority Cleanup & Documentation. Feedback comment explicitly recommended doing this before modularization begins.

Priority

Medium — Important to establish before main.py modularization (#473) begins. Each module extraction will be a structural change worth recording. 30-minute effort with no risk to existing functionality.

🔍 Task mining by Discussion Task Miner - Code Quality Improvement Agent

To install this agentic workflow, run

gh aw add github/gh-aw/.github/workflows/discussion-task-miner.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4

• expires on Mar 4, 2026, 5:35 AM UTC

[linear]

ABH-466