docs: complete the v2.1.0 CHANGELOG release summary

[codeforester]

Goal

Complete the CHANGELOG.md entry for the published v2.1.0 release so it accurately summarizes the notable user-facing, security, release, and distribution work merged before tag v2.1.0.

Background

The v2.1.0 entry was prepared in #441 and matches the current GitHub Release notes, but the final release range through commit 36fec50 also contains notable work that is not represented in the changelog, including the reusable process module and injected prompt descriptors, immutable generated-workflow pins, standalone-bundle application metadata preservation, stable manifest dependency closure, candidate release-invariant selection, and ecosystem BOM component evidence.

Scope

• Update only the v2.1.0 section of CHANGELOG.md.
• Add concise bullets under the existing Keep a Changelog categories.
• Ground claims in the v2.0.0..v2.1.0 history and published release evidence.
• Preserve the existing Unreleased and historical sections.
• Do not claim release assets that are not attached to the published GitHub Release.

Acceptance Criteria

• The v2.1.0 section includes the omitted notable public, security, distribution, and release-governance work.
• The wording remains concise and user-facing rather than becoming a commit-by-commit dump.
• git diff --check passes.
• ./tests/validate.sh passes.
• No files other than CHANGELOG.md are changed.

Validation

• git diff --check
• ./tests/validate.sh

Non-Goals

• Do not republish, retag, or modify the immutable v2.1.0 release.
• Do not change VERSION, README release metadata, release assets, or source behavior.

Project Fields

• Status: Backlog
• Priority: P2
• Area: Product
• Initiative: Adoption Polish
• Size: S
• Milestone: v2.2.0

Agent Assignment

• Assignee: codeforester