docs(changelog): move the #11200 entry into the existing Changed section

Review feedback: [Unreleased] already had a Changed heading; a second one
broke the Keep-a-Changelog structure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SrKzcwZBnref1sWYtdXynu

Author: MarkusNeusinger

CHANGELOG.md

@@ -26,17 +26,6 @@ aggregate instead: an italic *Catalog* line at the end of the version section an
 
 ## [Unreleased]
 
-### Changed
-
-- **CodeQL moves to an advanced-setup workflow that skips `plots/**`** — the default
-  setup scanned five languages on every push to an `implementation/*` branch and every
-  impl-* pull request; during the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs
-  waited in the runner queue at once, ahead of the pipeline's own jobs. The new
-  `.github/workflows/codeql.yml` keeps the same languages and weekly schedule but ignores
-  `plots/**` both as a trigger and inside the analysis, so pipeline PRs no longer start
-  a scan. Default setup has to be switched off in the repository settings for the
-  workflow's uploads to be accepted. (#11200)
-
 ### Fixed
 
 - **The watchdog now rescues a repair that crashed after a rejection** — a PR carrying
@@ -83,6 +72,14 @@ aggregate instead: an italic *Catalog* line at the end of the version section an
 
 ### Changed
 
+- **CodeQL moves to an advanced-setup workflow that skips `plots/**`** — the default
+  setup scanned five languages on every push to an `implementation/*` branch and every
+  impl-* pull request; during the 4-slot backfill of 2026-09-02 up to 23 CodeQL runs
+  waited in the runner queue at once, ahead of the pipeline's own jobs. The new
+  `.github/workflows/codeql.yml` keeps the same languages and weekly schedule but ignores
+  `plots/**` both as a trigger and inside the analysis, so pipeline PRs no longer start
+  a scan. Default setup has to be switched off in the repository settings for the
+  workflow's uploads to be accepted. (#11200)
 - **The API image is built in two stages and drops two thirds of its weight** — the
   single-stage `api/Dockerfile` produced a 1.6 GB image (502 MB compressed in Artifact
   Registry) of which 277 MB compressed was ballast in two layers: `build-essential`,