repo-hygiene: add root CHANGELOG.md

[me-bender]

Summary

Adds a minimal root CHANGELOG.md so the lunar policy check changelog.changelog-exists passes. Detected on #47 (auto-bump catch-up PR), but the check is repo-level and pre-existing — every PR against main currently fails it.

What this PR does

• New CHANGELOG.md at repo root. 9-line index pointing to per-chart changelogs (charts/<name>/CHANGELOG.md) and noting that repo-level tooling history lives in git, not here.

The per-chart charts/lunar/CHANGELOG.md stays put — still the source of truth for chart releases.

Sibling fix

The lunar bot also flags instruction-file-exists (no root AGENTS.md/CLAUDE.md). That's already covered by #46 (draft, awaiting flip-to-ready). Once both PRs land, the two repo-hygiene failures clear for every future PR.

Test plan

• One file change, 9 lines.
• Auto-merge enabled — squash on approval.
• After merge, changelog-exists should pass on the next PR build.

[lunar-internal]

🌒 Earthly Lunar

❌ 1 Failing

• ❌ instruction-file-exists ai.instruction-file-exists - Verifies that an agent instruction file exists at the repository root. Checks
  ai.instructions.all[] which is populated by the ai collector (AGENTS.md) and
  tool-specific collectors via array append (CLAUDE.md, CODEX.md, GEMINI.md).
  Passes if any entry exists.

  • No agent instruction file found at repository root (e.g. AGENTS.md, CLAUDE.md, GEMINI.md)

More Details

✅ 12 Passing

• ✅ branch-protection-enabled vcs.branch-protection-enabled - Requires branch protection rules to be enabled on the default branch.
  Branch protection is the foundation for all other VCS security controls.

• ✅ build-tagged container.build-tagged - Requires container builds to use an explicit image tag via -t/--tag.
  Untagged builds produce anonymous images that cannot be tracked or deployed.

• ✅ changelog-exists changelog.changelog-exists - Verifies that a CHANGELOG file exists in the repository root. Detects
  common variants (CHANGELOG.md, CHANGELOG, CHANGES.md, HISTORY.md,
  RELEASES.md). Intended for repos that ship versioned releases — apply
  via lunar-config on: targeting (e.g. public-only) rather than blanketly.
  Reads from .repo.changelog.

9 more...

• ✅ codeowners-catchall repo-hygiene.codeowners-catchall - Requires a default catch-all rule (*) in CODEOWNERS so that every file
  in the repository has at least one owner.

• ✅ codeowners-exists repo-hygiene.codeowners-exists - Requires a CODEOWNERS file to be present in the repository.
  Checks standard locations: root, .github/, or docs/.

• ✅ codeowners-valid repo-hygiene.codeowners-valid - Validates that the CODEOWNERS file has correct syntax.
  Checks that all owner references use valid formats (@user, @org/team, or email).

• ✅ disallow-force-push vcs.disallow-force-push - Prohibits force pushes to protected branches to preserve commit history.
  Force pushes can destroy audit trails and cause data loss.

• ✅ no-latest container.no-latest - Prevents use of the :latest tag (explicit or implicit) in base images.
  Using :latest creates non-reproducible builds and makes debugging difficult.

• ✅ readme-exists repo-hygiene.readme-exists - Verifies that a README file exists in the repository root.
  Every repository should have basic documentation for discoverability.

• ✅ require-default-branch vcs.require-default-branch - Validates the default branch name matches the required name (default "main").
  Helps standardize branch naming across repositories.

• ✅ require-pull-request vcs.require-pull-request - Requires all changes to go through pull requests before merging.
  Prevents direct pushes to protected branches without review.

• ✅ stable-tags container.stable-tags - Requires base images to use stable tags: digests (sha256:...) or full semver (1.2.3).
  Partial versions like "node:20" can change unexpectedly and break builds.

More Details