docs: weekly documentation audit 2026-06-30

[krakenhavoc]

Weekly Documentation Audit — 2026-06-30

Supersedes #16.

Documentation gaps identified

• CHANGELOG.md [Unreleased] section was empty despite changes landed since v1.1.0
• Release pipeline trigger pattern was undocumented
• No entries covering PKI advisories that directly affect cert-action behaviour

Changes made

CHANGELOG.md — Added to [Unreleased]:

• Release Pipeline: trigger restricted to v[0-9]+.[0-9]+.[0-9]+ tags only; release notes auto-generated from CHANGELOG; make_latest: true
• PKI Advisory — SC-098v2: CAA RFC 8657 validationmethods and accounturi parameters; CA enforcement deadline March 2027; no cert-action config change required today
• PKI Advisory — Chrome EKU Separation: serverAuth/clientAuth EKU separation enforced 2026-06-15; affects DigiCert/Sectigo chains; Let's Encrypt (used by this action) unaffected
• PKI Advisory — CT Mandatory Logging: enforced 2026-06-15; DigiCert opt-out removed 2026-06-01; Let's Encrypt always CT-logged, no action required
• PKI Advisory — LE Merkle Tree Certificates: announced 2026-06-03; staging late 2026, production 2027; MTC breaks the chain.pem/fullchain.pem model — chain-path and fullchain-path outputs will need updates before the LE production rollout

Status note

#16 remains open and unmerged. This edition carries forward the same gaps — the fixes are now on branch claude/exciting-fermat-tbdkfw. Close #16 once this PR is reviewed.

Suggested version bump

v1.2.0 — once MTC compatibility work is scoped and at least one of the above [Unreleased] items ships.