docs(changelog): reconcile [Unreleased] with PRs merged since v0.21.0

[danielmeppiel]

TL;DR

Makes the CHANGELOG.md [Unreleased] block faithful to what has actually merged since the v0.21.0 tag. No version bump, no dated heading -- everything stays under [Unreleased]. This is changelog hygiene only; it does not cut a release.

What changed

Enumerated every PR merged after the v0.21.0 tag (commit 975f8f0, 2026-06-19 16:46) and reconciled the changelog against it.

Added to [Unreleased] (were missing)

• Add cascading policy repo discovery with ADO support #1830 -> new ### Added -- cascading org-policy repo discovery (.github -> .apm -> _apm) plus Azure DevOps Items API support, so ADO orgs can host a governance policy repo. (by @sergio-sisternes-epam; closes [BUG] Azure DevOps does not allow a .github repository for the policy file #1813)
• Fix apm pack omitting version for INTERNAL/private github.com repos #1854 -> ### Fixed -- apm pack no longer drops version for INTERNAL/private github.com marketplace repos (REST Contents API instead of the raw CDN, which 404s on private repos). (by @sergio-sisternes-epam)
• Fix cross-package file protection in stale cleanup (#1831) #1856 -> ### Fixed -- cross-package file-protection guard in stale cleanup. (by @sergio-sisternes-epam; closes apm install/update does not remove locally deployed files that were deleted from upstream package #1831)

Attribution fix

• Fix no-orphaned-packages false positive for local-path sub-package deps #1855 -- added the missing by @sergio-sisternes-epam credit (external contributor; consistent with the released entries).

Misfiled entry moved

• Fix marketplace install ignoring GitLab host for url-type sources (#1848) #1853 was listed under the released [0.21.0] section but merged 2026-06-20, after the v0.21.0 tag (verified: its commit is not an ancestor of the tag). Moved into [Unreleased] where it factually belongs.

Correctly omitted

• Remove daily test improver workflow #1870 (remove daily test-improver workflow) -- internal .github/workflows/ change, not user-facing.

Validation evidence

• Changelog-only diff (+21 / -5), printable ASCII per the encoding contract.
• No src/ or tests/ changes, so the CI lint mirror (ruff / pylint R0801 / auth-signals) has no new code surface to flag.

How to test

• git show --stat HEAD -- confirms a single-file (CHANGELOG.md) change.
• grep -c "#1853" CHANGELOG.md -- returns 1 (now only in [Unreleased], removed from [0.21.0]).

Note

Reviewer check on the #1853 move: if v0.21.0's published artifact was intended to include #1853, revert just that hunk. The branch base is a few commits behind main; the changelog hunks do not conflict (none of the post-tag PRs added their own [Unreleased] entries).

[Copilot]

Pull request overview

This PR updates CHANGELOG.md to make the [Unreleased] section accurately reflect PRs merged since the v0.21.0 tag, without cutting a release or introducing a new dated version heading.

Changes:

• Add a new [Unreleased] ### Added entry for #1830 (org-policy repo discovery cascade + ADO Items API).
• Add missing [Unreleased] ### Fixed entries for #1854 and #1856, and add missing external-contributor attribution for #1855.
• Move the #1853 fix entry from the 0.21.0 release section back into [Unreleased].

Show a summary per file

File	Description
CHANGELOG.md	Reconciles [Unreleased] entries and attribution with merges since v0.21.0, including moving #1853 out of the released 0.21.0 section.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 0