docs: record verified development delivery and explicit release gates

Document independent native architecture, server compatibility, build/signing procedures, privacy limitations and persistent continuation steps. Record two consecutive seven-test API 35 HTTPS/OIDC passes, portable and host-tool checks, and inspected unsigned artifacts. Explicitly withhold production readiness pending Apple SDK validation, API 37/current-device testing, real IdPs, resource-limit review, human security review and maintainer signing.

CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## [Unreleased]
+
+- Native Android HTTPS onboarding, origin-bound browsing, session persistence,
+  recovery, server erasure, camera/document selection, downloads and blob exports.
+- SwiftUI/WKWebView iOS implementation, isolated web sign-in, native settings,
+  recovery, file export, and strict URL/metadata policies; Xcode validation pending.
+- JVM, Android emulator, portable Swift, and real pinned-upstream HTTPS tests.
+- Reproducible build configuration, CI and maintainer-controlled signing workflow.
+- MIT licensing, upstream audit, security model and release documentation.
+
+No stable release has been published. No native push or browser-to-app session
+handoff is claimed. See validation records for what has actually been executed.