docs: keep a CHANGELOG.md, with one entry file per PR

Release notes were written by hand on GitHub at tag time, so the contents
of a stacked release had to be pieced together from every PR, and output
changes that scripts and agents rely on were easy to miss.

- CHANGELOG.md backfills every published release (0.2.0 to 0.4.0) from its
  GitHub notes, verbatim.
- A PR adds changes/unreleased/<branch-name>.md instead of editing
  CHANGELOG.md, so stacked PRs never conflict. changes/README.md gives the
  sections, including Output Changes for JSON, MCP and error-code changes.
- scripts/changelog.sh: `check` validates entries and CHANGELOG.md,
  `release X.Y.Z` folds the entries into a new section (ordered by PR), and
  `notes X.Y.Z` prints a section as GitHub release notes.
- The release workflow sets the GitHub notes from the tag's section.
- New flake check `changelog` runs scripts/changelog-test.sh; both scripts
  are shellchecked.
- Entries for 0.5.0: #73, #74, #75, #78, #79, #80, #81 and this PR.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

AGENTS.md

@@ -35,6 +35,7 @@ Docs:
 - `docs/DESIGN.md`: idx-core / idx-mcp design and parity gates
 - `docs/IDX_NEWS.md`: news sources research (IDX disclosures, Google News, Yahoo) and a proposed publisher design
 - `ROADMAP.md`: open work
+- `CHANGELOG.md` / `changes/README.md`: released changes / how a PR adds its entry
 
 ## Rules
 1. Keep data access provider-driven; no ad hoc fetches in `cli/`.
@@ -49,6 +50,9 @@ Docs:
 7. Output parity is a contract: never edit golden files to make a change pass.
    After changing CLI behavior, run the live check and report its summary;
    report IDX `403`s explicitly rather than counting them as passes.
+8. A PR that changes what users or agents see adds
+   `changes/unreleased/<branch-name>.md` (format in `changes/README.md`);
+   `Output Changes` lists any change to JSON, MCP results or error codes.
 
 ## Verify
 ```bash