docs(changelog): record dependency update merges (#136–#139)

[FunKite]

Summary

Repository maintenance pass over the open Dependabot pull requests. All four open PRs were reviewed against CI and merged into main, and this PR records them in the changelog under [Unreleased] → Changed.

Pull requests addressed (all merged)

• ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 #136 — actions/checkout 6.0.2 → 6.0.3 (CI). All 22 checks green.
• ci(deps): bump EmbarkStudios/cargo-deny-action from 2.0.19 to 2.0.20 #137 — EmbarkStudios/cargo-deny-action 2.0.19 → 2.0.20 (CI; bundled cargo-deny → 0.19.8). 21/22 checks green; the single Test Suite (windows-latest, beta) failure was a transient toolchain-setup failure (the job died during rustup/cache setup, before any test ran) and is unrelated to a workflow-action version bump.
• deps(deps): bump zerocopy from 0.8.48 to 0.8.50 in the rust-dependencies group #138 — zerocopy 0.8.48 → 0.8.50 (rust-dependencies group). All checks green.
• deps(deps): bump glam from 0.32.1 to 0.33.0 #139 — glam 0.32.1 → 0.33.0 (major bump). Full test suite, build, MSRV, clippy, and security checks all green; the breaking change only makes non-f32/bool types optional Cargo features (enabled by default), so the public API is unchanged.

Security

• Rust Security Audit, Cargo Deny (advisories), Cargo Deny (bans licenses sources), and Security Workflow Audit passed on each merged PR — no new advisories introduced by these updates.

Changes in this PR

• CHANGELOG.md: add four Changed entries documenting the merges above.

https://claude.ai/code/session_01Y8ZaYV67hWabWH4eJkVumM

---

Generated by Claude Code