docs: add CHANGES entry for PR trusteddomainproject#398 (OversignHeaders/SignHeaders docs and warnings)

Author: thegushi

CHANGES-202605.md

@@ -148,6 +148,10 @@ A systematic audit of memory and resource leaks (issue #272) produced fixes acro
 
 - **`opendkim.conf(5)` case-insensitivity**: Documented that config parameter names are case-insensitive. (#289)
 - **`SignHeaders` documentation**: Clarified semantics, added examples. (#292)
+- **`OversignHeaders`/`SignHeaders` interaction documented**: Clarified that entries in `OversignHeaders` must also appear in the signing set (`SignHeaders` or the compiled-in default) to provide any protection. A header in `OversignHeaders` but not in the signing set produces a technically valid signature but with silently absent oversigning protection. Also documented that `OversignHeaders` does not support the `*,+,-` delta syntax (unlike `SignHeaders` and `OmitHeaders`). Added a startup warning when this misconfiguration is detected. (#398, issue #131)
+- **`OmitHeaders` default documented**: The default list (Return-Path, Received, Comments, Keywords, Bcc, Resent-Bcc, DKIM-Signature) was previously described as "none". Corrected, and added a note that this list acts as a safety override — none of its entries appear in the default `SignHeaders` list, and a header present in both `SignHeaders` and `OmitHeaders` will not be signed (with a new startup warning when this is detected). (#398)
+- **`On-` handlers documentation**: Expanded `On-Default` documentation to include valid values and a production warning that `On-Default accept` silently disables all verification error enforcement. Added example configurations to the sample config. (#398)
+- **`opendkim.conf.sample` overhaul**: Corrected defaults, explained the `*,+,-` delta syntax for each option that supports it, added the "In Short" semantics summary for `SignHeaders`/`OversignHeaders`, and improved the `On-` section with concrete examples and values. (#398)
 - **IPv6 `PeerList` inline limitation**: Documented workaround using a file for IPv6 CIDR entries. (#318, issue #155)
 - **`SignatureAlgorithm` for ed25519**: Documented that `SignatureAlgorithm` must be explicitly set when using ed25519 keys. (#300, issue #107) -- superseded by #370; the setting is now auto-detected from the key type.
 - **Dual-algorithm signing example**: Added KeyTable example and caveats for signing with both RSA and ed25519. (#270)