docs(release): backfill CHANGELOG + CHANGELOG-at-release standard (v1.23.2)

[misnaej]

Patch hotfix to main: repairs the CHANGELOG gap left when v1.22.0/v1.23.0 promoted without entries, and documents+enforces (softly) the steady-state standard so it can't recur.

Why a hotfix to main

main already shipped v1.22.0 and v1.23.0 (via the #51 lump promotion) but CHANGELOG.md stopped at v1.21.0 — nothing enforces CHANGELOG updates at release. This is the one-time catch-up (see release-process.md §5 'one-time catch-up exception'). The steady-state flow (below) needs no hotfix.

Changes

• CHANGELOG.md — backfill v1.22.0 (block_protected_branches dev default; promotion-status minors-only; global tag resolver) and v1.23.0 (forge-config + layout config + /forge:test skill; any-tag guard fix; release-process spec). Minors-only per the doc's own rule — no v1.23.1 entry; patches fold forward.
• docs/release-process.md §5 — the standard: each minor's entry is authored on dev before promotion; the release branch carries it to main. dev is the single source — never hotfix/back-merge in steady state.
• next_prep.py — non-blocking --promotion-status advisory (⚠️) when a pending minor lacks a CHANGELOG entry on origin/dev. Silent for repos with no CHANGELOG. Patch-safe (Pattern C).
• plugin.json 1.23.1 → 1.23.2.
• New invariant→test row + 2 tests (9/9 promotion-status tests green).

After merge

• Tag v1.23.2 on main's squash commit (rolling-next).
• Back-merge main → dev (feature branch from dev, merge main) so dev's CHANGELOG matches — the one-time reconciliation. Then both branches align at 1.23.2.

Breaking changes

None — advisory is non-blocking, additive.

[misnaej]

Squash-merge message (copy verbatim):

docs(release): backfill CHANGELOG, document CHANGELOG-at-release standard

- Backfill main CHANGELOG with v1.22.0 + v1.23.0 entries (minors-only)
- release-process.md §5: entry authored on dev before promotion (single source)
- Non-blocking promotion-status advisory for a missing entry (#53 tracks blocking)
- Bump plugin.json to 1.23.2; add invariant→test row + 2 tests