docs(changelog): roll shipped v0.16.2, v0.16.3, v0.16.4 out of Unreleased

[joshua-temple]

Problem

CHANGELOG.md's newest rolled section was [0.16.1], but v0.16.2, v0.16.3, and v0.16.4 are all published (2026-07-17). Every shipped fix (reaper pagination, retries ladder, trunk_branch enforcement, and the rest) sat under ## [Unreleased], so a reader concluded the shipped work was unreleased. The preamble's claim that the file and the release notes tell the same story did not hold.

Root cause

No automated roll exists. The generate-changelog subcommand only builds git-derived release notes for the GitHub Release from a commit range; nothing rewrites CHANGELOG.md. The file is maintained by hand, and the roll from [Unreleased] into a versioned section was simply never done for the last three releases. The freshness guard (TestChangelog_UnreleasedCoversUserFacingCommits) only catches a lagging Unreleased, not an unrolled release, so the drift was invisible.

Fix

Manual roll. Each entry is attributed to the release that shipped it by the commit range that added it to the file (git diff v0.16.N v0.16.N+1 -- CHANGELOG.md), not by guesswork:

• ## [0.16.2] gets 12 entries, ## [0.16.3] 18, ## [0.16.4] 8, all dated 2026-07-17 (their publish dates).
• The 9 genuinely unreleased entries (fix(state): preserve state.components on flat single-component write #630 through fix(generate): close four silent generated-output defects #634) stay under ## [Unreleased].
• Compare links add v0.16.2/3/4 and repoint [Unreleased] at v0.16.4...HEAD.
• The preamble is reconciled: it now states each versioned section is rolled out of [Unreleased] when its release is cut, rather than implying the two are kept identical automatically.

An automated roll (a release-time step that rewrites and commits CHANGELOG.md) is the true long-term fix but is a substantial, higher-risk release-workflow change; recommending it as a separate followup rather than bundling it here.

Verification

• TestChangelog_UnreleasedCoversUserFacingCommits passes post-commit (the guard is inert until committed).
• Whole-file bullet count conserved (248 before and after); every moved entry verified against its shipping release's commit range.
• go build ./... and golangci-lint run ./... clean.

Not fleet-relevant: pure CHANGELOG roll, no generator, workflow, or release-path change.