chore(core/docs): changelog automation, ref alignment, constants unification, safety sweeps

[flyingrobots]

This PR addresses the latest architecture/API and safety review items and adds a small CHANGELOG workflow.

Highlights

• Changelog automation

  • tools/changelog/add_entry.py (daily dev log entries with time + short SHA)
  • Make target: make changelog-add m="One-liner" n="Optional note"
  • pre-push hook: blocks pushes to main without CHANGELOG updates (bypass: HOOKS_BYPASS=1 git push)
  • docs/DEV_SETUP.md updated with hook setup and usage

• Journal + refs alignment

  • Added GITMIND_EDGES_REF_PREFIX (refs/gitmind/edges/)
  • New helper gm_build_ref(out, sz, prefix, branch) for safe ref construction + branch validation
  • Writer/reader now build refs via gm_build_ref

• Constants unification

  • Removed duplicate core/include/gitmind/constants.h (public constants live in include/gitmind/constants.h)
  • Moved CBOR constants to include/gitmind/cbor/constants_cbor.h and removed internal duplicate
  • Include order adjusted (public include/ first)

• Path + safety sweeps

  • Normalized GM_PATH_MAX=4096, removed *2 path buffers, added bounds-checked ref/path building with gm_snprintf
  • Replaced lingering ZERO_SHA string writes with safe defaults; no baked SHA strings in core logic
  • Added extern "C" wrappers to public headers; attribution.h now includes edge_attributed.h to avoid duplication

• Tests

  • Cache query e2e (fanout/fanin after rebuild)
  • Journal mixed CBOR (covered in prior PRs)

• Docs

  • Expanded “talk shop” docs with Mermaid diagrams
  • Recorded rejected suggestions: keep deprec macros (one release), keep c_std=c23 for CI/tooling alignment

Why

• Enforce OID-first semantics consistently
• Remove public/internal drift (constants)
• Harden ref/path construction and eliminate unsafe libc usage in core
• Establish a light but effective CHANGELOG habit

Follow-ups

• Purge the remaining raw libc calls in core (replace with gm_* wrappers) and add truncation tests
• Add journal ref construction tests (branch validation and bounds)
• Optional CI check mirroring the local pre-push CHANGELOG guard
• Consider a simple hash mixer for cache map to reduce pathological clustering; document distribution invariants

Summary by CodeRabbit

• New Features

  • Enforced pre-push changelog & worksheet checks with bypass, local CI runner, new Make targets (changelog-add, md-verify, ci-local, docs-verify), and workflows to seed/apply review worksheets plus auto-label docs PRs.

• Refactor

  • Safer memory/string handling, centralized ref-builder, OID‑first migration (binary OID in cache metadata), unified error/result semantics and added unused-result (nodiscard) annotations.

• Tests

  • New unit tests for ref utils, OID-fallback equality, shard distribution, branch-name limits, and tree-size.

• Documentation

  • Wide front-matter standardization, new docs and tooling (CBOR debug, review seeding, features ledger), templates, and automated ledger updates.