docs: weekly audit — CHANGELOG [Unreleased]: release pipeline, PKI advisories

[krakenhavoc]

Documentation Audit — Week of 2026-05-26

Gap identified

CHANGELOG.md had an empty [Unreleased] section despite three meaningful additions since v1.1.0:

1. The release workflow was restricted to tag-triggered runs (v*.*.* pattern) — undocumented.
2. SC-098v2 (CA/B Forum ballot, RFC 8657 CAA accounturi/validationmethods mandatory March 2027) — no advisory.
3. Chrome EKU separation (TLS intermediates must be serverAuth-only from 2026-06-15) — no advisory. Let's Encrypt is unaffected; DigiCert/Sectigo users would need re-issuance.

Changes in this PR

• CHANGELOG.md — populated [Unreleased] with:
  • Release Pipeline: restricted trigger pattern, structured release notes, make_latest: true
  • PKI Advisory — SC-098v2: enforcement date, impact on dns-01 challenges, recommended CAA record update
  • PKI Advisory — Chrome EKU Separation: what changed, which CAs are affected, confirmation that Let's Encrypt (used by this action) is unaffected

Suggested version bump

No functional code changes in this audit window. The next release after documenting these additions is v1.2.0 (minor: new release-pipeline behaviour).

Supersedes

Open draft PR #12 (cert-action) — this PR covers all gaps noted in #12 plus the new PKI advisories.

---

Weekly documentation audit — 2026-06-02

[krakenhavoc]

Closing: superseded by #15 (latest weekly audit)