release: compile v3.2.0 changelog

[sumitake]

Summary

Compile the six pending changelog.d/ fragments into the generated CHANGELOG.md after the 3.2.0 provider-broker policy/client changes merged.

This is the release-preparation PR required before creating the signed annotated v3.2.0 tag. It changes only the generated changelog. The subsequent release remains policy-only: no native runtime artifact is present, installed, activated, or published.

Scope

• Only CHANGELOG.md changed.
• Source fragments remain canonical and unchanged.
• No provider executor, credential, private path, native artifact, installer, activation, or retired package surface is included.
• No additional changelog fragment is appropriate for this generated-artifact release PR.

Validation

• python3 scripts/build_skills.py --check
• python3 scripts/build_marketplace.py --check
• python3 scripts/build-changelog.py --check — six fragments match
• python3 -m unittest discover -s tests -t . -v — 273 passed
• python3 -m unittest discover -s scripts -p 'test_*.py' -v — 254 passed
• python3 scripts/check_release_consistency.py
• python3 scripts/secret_scan.py — 175 source text files clean
• python3 scripts/check-public-export-safety.py --active-tree --history — safe
• Policy-only archive and deterministic checksum/SPDX evidence rehearsal — passed
• git diff --check

Post-merge condition

After this PR merges, refresh a clean checkout of main, run python3 scripts/cut_release.py --dry-run, then python3 scripts/cut_release.py. Verify the signed annotated tag, release workflow, policy-only archive, checksum, SPDX evidence, and absence of a native runtime. Do not install or activate the plugin/runtime as part of this release.

Compliance trace

author: Codex
standing_directives: generated changelog only, policy-only release, signed annotated tag, deterministic release and public-export validation
tier: 1
cross_check: N/A — deterministic generated-artifact release PR with no code, policy, runtime, or activation change
post_condition: exact commit 1317fad changes only CHANGELOG.md and passes 273 public tests, 254 script tests, archive evidence, secret scan, and active/history export safety
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: yes

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!