Follow-up: add changelog entry for PR #350 review-app security docs

[justin808]

Finding

PR #350 added user-facing review-app security documentation in docs/ci-automation.md and docs/secrets-and-env-values.md, but the merge did not add a matching CHANGELOG.md entry under Unreleased.

Evidence

• PR: Clarify review app security guidance #350
• Merged commit: 5f092dde9dfe55d1637d7daf78796c6f549e3051
• Changed files in Clarify review app security guidance #350:
  • docs/ci-automation.md
  • docs/secrets-and-env-values.md
• git diff --name-only 617f4a22f07584b7dd08cc5ea6f30fb041575b6e..5f092dde9dfe55d1637d7daf78796c6f549e3051 shows only those two docs files.
• git diff -- CHANGELOG.md 617f4a22f07584b7dd08cc5ea6f30fb041575b6e..5f092dde9dfe55d1637d7daf78796c6f549e3051 is empty.
• AGENTS.md says CHANGELOG.md is Keep-a-Changelog and should include user-visible changes.

Suggested follow-up

Run the repo changelog workflow or add one concise Unreleased entry for the review-app security documentation from PR #350. This can be bundled with the next changelog maintenance pass if that is preferred.

Audit context

• Audit mode: completed-batch audit
• Batch id: cpflow-first-safe-wave-auto-20260630-f68f
• Audit ledger: not applicable (non-release audit)