Self-hoster release contract: changelog, upgrade guide, tagged releases

[important-new]

Before external self-hosters arrive, the repo needs a release contract:

• Catch the CHANGELOG up (it currently stops months behind main)
• An upgrade guide for existing installs (pull → migrate → deploy), including the forward-only D1 migration playbook
• Start tagging releases / GitHub Releases
• A short breaking-change & deprecation policy