docs(changelog): record the drift guard, the index alignment and the inventory

Unreleased: the schema-drift guard and reserved/unused inventory, the
canonical-id / microsecond-truncation and shared-timeline coverage, and the
SQLite index alignment (`jobs_ready` key, new `job_requests_attempts`) with
its before/after EXPLAIN QUERY PLAN.

Author: Bnjoroge1

CHANGELOG.md

@@ -8,6 +8,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Releases before v0.27.0 predate the changelog.
 ## [Unreleased]
 
+### Added
+
+- A schema-drift guard keeps the SQLite (`control/lite/schema.sql`) and
+  Postgres (`control/pg/schema.sql`) control schemas aligned: same tables,
+  column names, foreign keys and indexes, with every deliberate difference
+  listed and reasoned in `control/schema_drift.rs` (partition children, the
+  xid8 outbox columns and their ordering index, the GIN label index, the
+  pg-only `job_messages.job_timeout_s`, the shared `timeline_id`, and the
+  `runner_sessions.runner_id` FK). The guard fails on an undocumented
+  difference and on a stale entry, so aligning the backends shrinks the list
+  instead of letting it rot. The same module inventories the schema objects
+  kept without readers — `RESERVED` placeholders (`namespace_policies`, three
+  unread `namespace_limits` columns, `artifacts`) and `UNUSED` leftovers
+  (`namespaces.cell_generation`/`config_version`,
+  `run_submissions.secret_refs`, `jobs.not_before`,
+  `provision_requests.lease_owner`/`leased_until`,
+  `runner_sessions.engine_node_id`, `log_files.byte_count`/`line_count`,
+  `artifacts.upload_token_hash`/`finalized_at`) — and a grep test fails when
+  code starts using one, so the inventory cannot silently stale. Nothing is
+  dropped and no schema version is bumped: this branch has no migration
+  runner, so dropping a column would strand every existing control database.
+- Coverage for id and time storage on both backends: a run id and job
+  round-trip in lowercase-canonical form, a sub-microsecond instant reads
+  back as whole microseconds (nanosecond `bigint` stamps keep full
+  precision), SQLite accepts several attempts of one job sharing a
+  `timeline_id` (the deliberate pg-`UNIQUE` divergence) and its
+  `job_requests_timeline_cascade` trigger prunes the shared timeline with the
+  last request.
+
+### Changed
+
+- SQLite's `jobs_ready` key is now `(pool_key, priority DESC, run_order,
+  job_order)` — exactly the claim / ready-queue `ORDER BY`, the key Postgres
+  already carries. `namespace_id` sat between the pool key and the priority,
+  so SQLite sorted the last three ORDER BY terms on every poll; the claim
+  query now reads the ready front in index order (`EXPLAIN QUERY PLAN` goes
+  from `USE TEMP B-TREE FOR LAST 3 TERMS OF ORDER BY` to no sort). SQLite
+  also gains `job_requests_attempts (run_id, job_id, request_id DESC)`, the
+  same index Postgres has, which serves the latest-attempt lookups and the
+  `jobs` -> `job_requests` cascade that the partial inflight index cannot.
+  Both are fresh-database changes: an existing database keeps working
+  unchanged, because a missing index is never an error.
 
 ### Security