docs(changelog): prepare 0.26.0 release notes

[solomonneas]

Summary

• Group the unreleased lifecycle-journal release notes under Added, Changed, Fixed, and Removed.
• Cover journal authority, recovery, approvals, live control, redaction, privacy, and outcome-ledger follow-ups through PR fix(redaction): survive crash between parent retirement and child realign (#652) #655.

Verification

• brigade work verify run --target . --command ./scripts/verify --capture brigade-work
• Receipt: 20260801-205211-work-verify-d1e619 - 5,678 passed, 3 skipped, 83.03% coverage.

Release decision

pyproject.toml and src/brigade/__init__.py declare 0.25.1, and CHANGELOG.md has a 0.25.1 section, but there is no v0.25.1 Git tag. This PR neither creates a tag nor changes the version. Before cutting 0.26.0, decide whether it supersedes the prepared 0.25.1 release or whether v0.25.1 should be tagged retroactively.

External review requested before merge.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d700576e-4e1a-4781-b607-121512ff6c79

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[solomonneas]

Updated the 0.26.0 Unreleased notes after rebasing onto origin/main.

Added:

• feat(runs): offline coordinator decision audit (#595) #649: brigade runs audit read-only lifecycle-evidence audit.

Fixed:

• fix(notify): harden init against symlink/TOCTOU writes (#616) #643: init symlink and TOCTOU write hardening.
• fix(dispatch): bound ledger root, name missing interpreters, surface stale inventory (#657) #662: target-bound outcome writes, Python remediation, stale-inventory remediation, and DAG admission.
• fix(outcome): diagnose and repair completed-ledger digest chain breaks #645: completed-ledger digest-chain diagnosis and repair.
• fix(run): retain the worktree of a failed run with uncommitted work (#656) #663: failed-run worktree retention and later pruning.
• fix(outcome): attribute capture to the exercised skill, not brigade-work #647: outcome capture attribution to the exercised skill.

PR #660 is still open, so it is not included.

Verification: ./scripts/verify passed through Brigade: 5730 passed, 3 skipped. Receipt: 20260801-220255-work-verify-4a1b5b.