docs: backfill missing CHANGELOG entries (2.4.1, 2.4.3-2.4.7)

[imchintoo]

What does this PR do?

Backfills 6 missing CHANGELOG.md entries — 2.4.1, 2.4.3, 2.4.4,
2.4.5, 2.4.6, 2.4.7 — none of which had a changelog entry despite
having shipped. Each entry was reconstructed from the actual git history
(git diff between the relevant version-bump commits), not written from
memory or invented:

• 2.4.1 — verified as a version-only republish (package.json/lockfile
  bump, zero code diff against 2.4.0). Documented as such rather than
  silently omitted.
• 2.4.3 — the TypeScript 7 silent-failure fix (task-ts7-01–04):
  parse failures were previously logged but didn't affect exit code or
  the "all clean" message on any of the 6 CLI modes; now they force a
  non-zero exit and an honest message. typescript range pinned
  <7.0.0. New test/cli-failure-accounting.test.js.
• 2.4.4/2.4.5 — CI reliability fixes (Node version bumps, an npm
  sigstore publish-workflow bug pinned around, perf-gate threshold
  4.5x→5.0x) plus the GitHub Pages documentation site launch
  (scripts/build-pages-docs.js, docs-site/).
• 2.4.6/2.4.7 — docs-site content expansion, a markdown-renderer
  bug fix (lists/bold/links weren't consistently handled), and a big
  README trim now that the full walkthrough lives on the docs site.

A short disclosure note is added at the top of CHANGELOG.md stating
these entries were reconstructed retroactively and on what date, so
nothing is presented as if it were written contemporaneously.

No code changes — CHANGELOG.md only. The public GitHub Pages
changelog page renders directly from this file at build time
(scripts/build-pages-docs.js's renderChangelog() reads CHANGELOG.md
itself, no separate copy to keep in sync) — verified locally in a scratch
copy that node scripts/build-pages-docs.js picks up all 8 versions
(2.4.0–2.4.7) correctly with no rendering errors.

Related issue

Chintan's feedback: CHANGELOG.md had no entries between 2.4.3 and 2.4.7,
and was missing 2.4.1 — a trust/credibility gap for a project whose whole
pitch is "no AI, no surprises." This closes that gap with git-verified
content only; nothing was fabricated to fill space.

Checklist

• npm test passes locally — no code changed by this PR, so no test
  regressions possible; skipped a full re-run for this doc-only change.
• Added/updated tests — n/a, documentation-only change.
• No new runtime dependency added.
• Output remains deterministic — n/a, markdown content only.
• Updated CHANGELOG.md — this PR's entire purpose.

Follow-up (not in this PR)

docs/backlog doesn't have per-version tickets for 2.4.3–2.4.7 pointing
back to individual commits (task-ts7-* covers 2.4.3's content, but
2.4.4–2.4.7 have no backlog trail at all). Worth a future decision on
whether every release needs a backlog entry going forward, or whether
CI/CD-only and docs-only releases are exempt.