docs(changelog): restore entries lost with the deleted release branch

[JeroenSoeters]

Summary

• Restore three unreleased CHANGELOG entries whose only home was a release branch that was deleted without merging back to main. The code shipped to main; the notes did not:
  • Added: Secrets Manager secrets adopt formae's first-class secret types (secret.res.secretValue, .json("path"), existing accessors unchanged).
  • Fixed: resources no longer reported as failed while AWS is still rate-limiting a request; the plugin bounds per-request retry time so the agent sees continuous progress.
  • Fixed: a Secrets Manager resource policy is replaced as a whole document, so patch-mode statement edits no longer leave old and new statements live together.
• Text restored verbatim from the orphaned docs commit, minus a per-entry formae-version requirement line that is now redundant with the section-level requires note.