docs: keep a CHANGELOG.md, with one entry file per PR

Release notes were written by hand on GitHub at tag time, so the contents
of a stacked release had to be pieced together from every PR, and output
changes that scripts and agents rely on were easy to miss.

- CHANGELOG.md backfills every published release (0.2.0 to 0.4.0) from its
  GitHub notes, verbatim.
- A PR adds changes/unreleased/<branch-name>.md instead of editing
  CHANGELOG.md, so stacked PRs never conflict. changes/README.md gives the
  sections, including Output Changes for JSON, MCP and error-code changes.
- scripts/changelog.sh: `check` validates entries and CHANGELOG.md,
  `release X.Y.Z` folds the entries into a new section (ordered by PR), and
  `notes X.Y.Z` prints a section as GitHub release notes.
- The release workflow sets the GitHub notes from the tag's section.
- New flake check `changelog` runs scripts/changelog-test.sh; both scripts
  are shellchecked.
- Entries for 0.5.0: #73, #74, #75, #78, #79, #80, #81 and this PR.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

changes/unreleased/stockbit-movements.md

@@ -0,0 +1,7 @@
+### New Features
+
+- `idx ownership movements` and `get_shareholder_movements` list reported changes in insiders' and major holders' stakes from your Stockbit session, newest first. `IDX` rows are insider disclosures with the trade price; `KSEI` rows are holders at 5% and above, with a price Stockbit estimates. Stockbit filters by date, holder, action and source, and `--pages` reads up to 10 pages of 50 rows. If a later page fails, you get the rows read before it, with `incomplete` saying why. (#80)
+
+### Improvements
+
+- The `ownership` commands honour `--offline` and `--no-cache`; only `movements` uses them. (#80)