cookpete auto-changelog

• CVE-2026-12171 High 7.8 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF 0.2%