Refine v0.9.0 changelog: keep PR coverage bullets, remove PR-number labels, and clarify O(1) borrow/unsafe boundary semantics

[Copilot]

The v0.9.0 release notes needed to keep PR coverage content while removing PR #... prefixes and standardizing formatting. This update also adds explicit wording for O(1) borrow checking and unsafe boundary behavior (unsafe class/method modifiers with safe(...) required in safe contexts).

• Changelog structure and formatting

  • Kept ### 🔀 Merge Coverage for This Snapshot and preserved each PR-derived item as a readable topic bullet.
  • Removed raw PR-number labels and normalized entries to consistent **topic** — detail style.

• Borrow-checking clarity

  • Strengthened wording to explicitly call out O(1) borrow checking via active-borrow tracking.
  • Clarified the shift from scan-based checks to active tracking.

• Unsafe boundary semantics

  • Added explicit release-note language that unsafe is supported as a class/method modifier.
  • Clarified that unsafe calls from safe contexts require safe(...), and direct safe-context calls are rejected.

- **O(1) borrow checking via active-borrow tracking** — Borrow-state checking moved from scan-based checks to O(1)-style active tracking for lower runtime overhead.
- **Unsafe operation boundary model implementation** — `unsafe` class/method modifier support with enforced `safe(...)` wrapping for calling unsafe operations from safe contexts (direct safe-context calls are rejected).