feat: CHANGELOG enforcement infrastructure

[rocketman-code]

Summary

Establishes a compile-time-enforced CHANGELOG architecture across four atomic commits:

1. Workspace migration (atomic-rollback moves into crates/atomic-rollback/)
2. Back-fill: changelog-core crate holds Fragment + VersionId + Status + Section + generator; all v0.1.1-v0.4.0 history ported (56 fragments); CHANGELOG.md now generated; build.rs enforces drift via rustc panic
3. PR-time gate: structural paths-filter requires Fragment addition whenever crates/atomic-rollback/src/** is modified
4. CONTRIBUTING.md + docs/standards/changelog-fragments.md documenting the contract

Design derived from one axiom (make invalid states unrepresentable) applied to each decision. Implementation spec at docs/plans/changelog-enforcement.md (gitignored).

Why

Without this infrastructure, CHANGELOG.md is a hand-written artifact whose correspondence to actual code changes depends on maintainer discipline. Failure modes:

• User-facing change merged without CHANGELOG entry: silent until release
• CHANGELOG.md inconsistent with reality: no mechanical gate
• Release notes generated manually: prone to omission

After this PR:

• crates/atomic-rollback/src/** modified without Fragment = CI fails on PR (structural gate)
• Fragment variant added without classification = cargo build fails (rustc exhaustive match)
• Source of truth changed without CHANGELOG.md regen = cargo build fails (build.rs drift check)
• CHANGELOG.md is a mechanically generated artifact

Each failure mode is rustc- or CI-enforced. No trust, no self-reporting.

Architecture

Workspace layout:

crates/
  atomic-rollback/      (user binary; tests; unchanged)
  changelog-core/       (Fragment enum, VersionId enum, Section enum, Status enum, generate())
  changelog/            (bin + build.rs; depends on changelog-core)

changelog-core is isolated from atomic-rollback. A bug in changelog code cannot reach the user binary — they share zero compiled code.

Status has three variants:

• Released { version, section, text } — shipped in a past release
• Unreleased { section, text } — pending the next bump
• InternalOnly { description } — acknowledged change with no user-perceivable effect; not emitted to CHANGELOG.md

Test plan

All verified locally and confirmed by CI:

• Commit 1: cargo build --release clean; cargo test --release 23/23 atomic-rollback tests pass; binary reports atomic-rollback v0.4.0; atomic-rollback.spec / .copr/Makefile / .github/workflows/ci.yml unaffected
• Commit 2: cargo build --release clean across all 3 crates; cargo test --release 23/23 pass; cargo run -p changelog > /tmp/out.md && diff CHANGELOG.md /tmp/out.md zero output
• Drift check actually fires: edit CHANGELOG.md without regen causes cargo build to panic with the expected message
• Type system catches missing status arm: adding a Fragment variant without a match arm produces rustc E0004 non-exhaustive
• InternalOnly variant compiles AND is filtered from CHANGELOG.md output
• atomic-rollback binary smoke test: --version and --help work
• actionlint on .github/workflows/pr-fragment.yml: clean
• CONTRIBUTING.md links to docs/standards/changelog-fragments.md; standard is internally consistent
• CI tests (ubuntu-latest + macos-latest), x86_64 (Fedora VM), aarch64-cross, task-list-completed all pass on this PR
• CI fragment-required passes on this PR (commit 2 modifies both crates/atomic-rollback/src/** and crates/changelog-core/src/lib.rs per paths-filter logic)

Known follow-up

Issue #31: actionlint reports two pre-existing SC2086 shellcheck info-level warnings in .github/workflows/ci.yml (unrelated to this PR's scope). Will be addressed in a dedicated small PR after this merges.

Post-merge motion (binding; same pattern as PRs #23, #29)

The workflow existing in the repo is advisory until added to required checks. Completion contract:

1. After merge, run:

gh api -X POST repos/rocketman-code/atomic-rollback/branches/main/protection/required_status_checks/contexts \
  --input - <<'IN'
{
  "contexts": [
    "fragment-required"
  ]
}
IN

2. Verify with:

gh api repos/rocketman-code/atomic-rollback/branches/main/protection --jq '.required_status_checks.contexts'

Expect six contexts: x86_64, aarch64-cross, tests (ubuntu-latest), tests (macos-latest), task-list-completed, fragment-required.

The merge is incomplete until the API call runs and verification passes.