fix(changelog): remove stale Unreleased entry and guard against manual entries

[jamescrosswell]

Why the 6.7.0 changelog broke

The 6.7.0 release shipped with a single changelog entry despite dozens of merged PRs.

Root cause: the repo generates its changelog automatically via craft (changelogPolicy: auto in .craft.yml). Craft only regenerates the ## Unreleased section when it is empty (prepare.ts — if (!changeset.body) guards the git-based generation, and the body is .trim()-ed first). A stale, hand-written entry (#5025) had been left under ## Unreleased, so craft saw non-empty content, skipped generation entirely, and just renamed ## Unreleased → ## 6.7.0. Everything else was silently dropped.

That stale line got there because CONTRIBUTING.md still instructed contributors to hand-add ## Unreleased entries — contradicting the auto policy (and AGENTS.md/CLAUDE.md, which already say do not add changelogs manually).

How changelog entries are meant to be produced

Under changelogPolicy: auto, nobody edits CHANGELOG.md. craft builds each entry one of two ways:

1. From the commit message / PR title — the default. A feat: PR becomes a Feature, a fix: PR a Fix, etc.
2. From a ### Changelog Entry section in the PR description — if present, craft uses that text verbatim instead of the title, which lets a PR provide a richer or multi-line entry (or several entries). See craft docs.

Either way, the ## Unreleased section must stay empty so craft regenerates it at release time.

Changes

• CHANGELOG.md — remove the stale manual ## Unreleased entry so craft regenerates 6.7.0 from git history (the feat: Add exponential backoff and log deduplication to Spotlight #5025 feature is still captured — it's a feat: commit in range).
• .github/workflows/changelog-guard.yml + scripts/verify-changelog.sh — a Changelog Guard check that fails any PR leaving content under ## Unreleased. It mirrors craft's own emptiness test: any non-whitespace content fails (a bullet, or even a bare ### Features sub-heading), while an empty ## Unreleased heading passes. Reports the offending CHANGELOG.md line numbers. Runnable locally: ./scripts/verify-changelog.sh.
• CONTRIBUTING.md — replace the stale "add a ## Unreleased heading" instructions with the automatic-changelog policy, documenting both entry mechanisms above.
• AGENTS.md — add a Getting Started note to check out submodules first (./dev.cs cleanslate); without them, tooling like generate-solution-filters.ps1 silently drops projects from the *.slnf files.
• Sentry.slnx / .generated.NoMobile.slnx — register the new workflow and script in the solution.

Follow-up (not in this PR)

The 6.7.0 release itself needs to be re-cut after this lands so craft regenerates the full changelog. Consider making Changelog Guard a required status check.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.24%. Comparing base (373e860) to head (b9cdf5f).
⚠️ Report is 6 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5369   +/-   ##
=======================================
  Coverage   74.24%   74.24%           
=======================================
  Files         509      509           
  Lines       18412    18412           
  Branches     3604     3604           
=======================================
  Hits        13670    13670           
  Misses       3869     3869           
  Partials      873      873           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c5771de. Configure here.}

[Flash0ver]

🤘