docs: weekly documentation audit 2026-06-16

[krakenhavoc]

Weekly Documentation Audit — 2026-06-16

Supersedes #14.

Documentation gaps identified

• CHANGELOG.md [Unreleased] section was empty despite several changes landed since v1.1.0
• Release pipeline trigger pattern was undocumented
• No entries covering PKI advisories that directly affect cert-action behaviour

Changes made

CHANGELOG.md — Added to [Unreleased]:

• Release Pipeline: trigger restricted to v[0-9]+.[0-9]+.[0-9]+ tags only; release notes auto-generated from CHANGELOG; make_latest: true
• PKI Advisory — SC-098v2: CAA RFC 8657 validationmethods and accounturi parameters; CA enforcement deadline March 2027; no cert-action config change required today
• PKI Advisory — Chrome EKU Separation: serverAuth/clientAuth EKU separation enforced 2026-06-15; affects DigiCert/Sectigo chains; Let's Encrypt (used by this action) unaffected
• PKI Advisory — CT Mandatory Logging: enforced 2026-06-15; DigiCert opt-out removed 2026-06-01; Let's Encrypt always CT-logged, no action required
• PKI Advisory — LE Merkle Tree Certificates: announced 2026-06-03 (new this week); staging late 2026, production 2027; MTC breaks the chain.pem/fullchain.pem model — this action will need updates before the production rollout

Suggested version bump

v1.2.0 — once MTC compatibility work is scoped and at least one of the above [Unreleased] items ships.