docs: add [0.2.1] changelog for post-0.2.0 merges

[clean6378-max-it]

Closes #156

CHANGELOG.md had an empty [Unreleased] block and nothing past v0.2.0.
Seven PRs landed on master since that tag (#145 through #151, plus #158) with no release notes.

This PR adds a [0.2.1] section dated 2026-07-30, grouped into Added, Changed, and Fixed to match the existing format. Security work (#145, #147), Playwright XSS coverage (#151), structured API errors (#146), the composers-50 bench gate change (#148), multi-worker set-workspace 409 (#150), and the summary-cache lock (#158) each get a one-line entry tied to the merge commit.

[Unreleased] is cleared and the footer compare links point at v0.2.1. No pyproject.toml version bump here; that stays in is-10.
o check: git log v0.2.0..HEAD --oneline against the new bullets, and confirm git diff master...HEAD --stat only touches CHANGELOG.md.

Summary by CodeRabbit

• Security
  • Strengthened Content Security Policy with restrictive per-response nonces for inline bootstrapping (including frame-ancestors 'none' and limiting images to self/data:), plus integrity pinning for syntax-highlighting resources.
  • Further improved safe Markdown rendering protections.
• Bug Fixes
  • Fixed workspace highlighting when the syntax-highlighting script fails to load due to a CDN miss, preventing skipped hljs.highlightElement.
  • Clarified multi-worker conflict handling for /api/set-workspace returning HTTP 409.
  • Reduced summary-cache race conditions by serializing the read/compare/write flow under a module lock.
• API Improvements
  • Clarified structured { error, code } bodies apply to key routes (workspaces, composers, search, export, PDF, config).
• Documentation
  • Updated v0.2.1 wording and adjusted compare links (including [Unreleased] as v0.2.1...HEAD and adding a [0.2.1] compare link).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3133bd8a-bcf3-4494-bd9c-81357e7d809f

📥 Commits

Reviewing files that changed from the base of the PR and between 5ab2a0c and b692e30.

📒 Files selected for processing (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

---

📝 Walkthrough

Walkthrough

CHANGELOG.md adds the dated 0.2.1 release section, refines its categorized entries, and updates the Unreleased and 0.2.1 comparison links.

Changes

Release notes

Layer / File(s)	Summary
Document 0.2.1 release CHANGELOG.md	Adds the dated 0.2.1 release entries and updates the [Unreleased] and [0.2.1] comparison links.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: wpak-ai

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the docs-only changelog backfill for the new [0.2.1] release notes.
Linked Issues check	✅ Passed	The changelog update adds the [0.2.1] section, clears [Unreleased], updates compare links, and covers the merged fixes and changes requested in #156.
Out of Scope Changes check	✅ Passed	The changes stay within CHANGELOG.md and do not introduce unrelated code or version-bump work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/changelog-0-2-1-backfill

---

_{Comment @coderabbitai help to get the list of available commands.}

[bradjin8]

Nit (non-blocking): Added bullets are ordered #147, #145, #151
merge chronology was #145 → #147 → #151. Reordering would match git history but doesn't affect release notes.