[docs] Add CHANGELOG.md (consolidate scattered RELEASE_NOTES_*.md)

[gapilongo]

Problem

Version history is currently spread across:

• RELEASE_NOTES_alpha_v0.1.md
• RELEASE_NOTES_v12.md
• RELEASE_NOTES_v13.md
• RELEASE_NOTES_v13_1.md
• Recent v13.2 → v13.7 covered only in commit messages + the v13.7 release body on GitHub

There's no single file to consult for "what changed when," and no [Unreleased] section for PR contributors to write into. The PR template (.github/PULL_REQUEST_TEMPLATE.md) already asks contributors to update CHANGELOG.md — but the file doesn't exist yet.

Acceptance criteria

• Create CHANGELOG.md in the repo root, following the Keep a Changelog format:

  # Changelog
  
  All notable changes to Pentest Copilot are documented in this file.
  The format is based on [Keep a Changelog](https://keepachangelog.com/),
  and this project adheres to [Semantic Versioning](https://semver.org/).
  
  ## [Unreleased]
  ### Added
  ### Changed
  ### Fixed
  ### Security
  
  ## [13.7] - 2026-05-27
  ### Added
  - LICENSE (Apache 2.0), SECURITY.md, CONTRIBUTING.md, PR template, CI workflow
  - Quality eval framework (`eval/quality/`) with judge calibration suite
  - 12 structural verifier rules (regression patterns + truncation detection)
  - ...
  
  ## [13.1] - ...
  ## [13] - ...
  ## [12] - ...
  ## [alpha-0.1] - ...

• Each released version section consolidates the corresponding RELEASE_NOTES_*.md content into the Added / Changed / Fixed / Security / Removed / Deprecated subsections
• Cross-reference each version to its git tag (when we backfill tags for v12, v13, etc.) — for now, link to the commit hashes that introduced each version's work
• Do NOT delete the existing RELEASE_NOTES_*.md files in this PR (separate cleanup); the CHANGELOG is the new canonical source going forward

Pointers

• Existing release notes: RELEASE_NOTES_alpha_v0.1.md, RELEASE_NOTES_v12.md, RELEASE_NOTES_v13.md, RELEASE_NOTES_v13_1.md
• v13.7 release body (full text on GitHub): https://github.com/gapilongo/pentest-copilot/releases/tag/v13.7
• v13.2 → v13.6 are in commit history — git log --oneline | grep -E "v13\.[2-6]"
• Keep-a-Changelog spec: https://keepachangelog.com/en/1.1.0/

Difficulty

S-M (2-4 hours) — mostly content consolidation; the format is well-defined.