docs(changelog): reconcile and promote [Unreleased] to [4.0.3] (#2891)

Release-cut reconciliation ahead of the 4.0.3 GA:

- Rename [Unreleased] -> [4.0.3] with the 2026-06-09 release date and a
  summary blurb, matching the 4.0.2 promotion format (#2824).
- Consolidate the duplicated ### Changed / ### Fixed sections that
  accumulated from incremental entry additions into one Added/Changed/Fixed
  trio (same order as the 4.0.2 block).
- Drop the byte-identical duplicate #2844 (protectedControllerMethods) entry.
- Add the missing consolidated entry for the 24-command CLI audit sweep
  (#2882, #2883, #2884, #2885).
- Fix the separator below the promoted block to exactly '---' (3 dashes) so
  release.yml's release-notes awk extraction terminates correctly (the
  #2606/#2768 footgun its Validate Release Checklist step guards against).

Cutting the release branch from develop AFTER this lands avoids the 4.0.2
back-port dance (#2824) where the rename lived only on the release branch.

Signed-off-by: Peter Amiri <peter@alurium.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: bpamiri