changelog: cut v0.1.0, and stop saying we do not cut releases

[ohohoreilly]

Stacked on #560 (the fragment fold) — the base shows only this commit once that merges. Draft for review; it is the "is this actually a release" decision, not a mechanical change.

Why 0.1.0 and not 1.0.0

Not a judgement call so much as matching what the project already claims everywhere else:

artifact	version
@orlyatomics/orly (npm)	0.1.0
orly-mcp (npm)	0.1.0
orly-repl (npm)	0.1.0
clients/go module tag	clients/go/v0.1.0

Tagging the repo v1.0.0 while every client it ships says 0.1.0 would be the odd choice. And 1.0.0 asserts a stability commitment that two gated RFCs — #218 (user-definable merges) and #255 (heterogeneous batched writes) — could still change out from under, along with the on-disk format.

What this actually buys

Worth being concrete, since the changelog has said "does not currently cut numbered releases" happily for months:

• An immutable image. :latest is a moving tag. Nobody can pin. A v* tag makes docker.yml push :v0.1.0-<arch> and stitch :v0.1.0.
• A version string in the binaries. make version runs git describe --tags --match 'v[0-9]*'; with no matching tag it falls back to a bare commit hash, so orlyc --help reports something meaningless today.

The change

Three things:

1. That header line, replaced with the process as it actually is — semver, with an explicit pre-1.0 caveat that the language, wire protocol and on-disk format can move between minor versions.
2. The folded [Unreleased] block moved under ## [v0.1.0] — 2026-09-17, with a short note that everything in it had already shipped.
3. An empty [Unreleased] left above it.

No entry text is edited.

One thing that would have broken quietly

The empty [Unreleased] keeps its ### Fixed subheading on purpose. fold_changelog.py anchors on the literal string "## [Unreleased]\n\n### Fixed\n" and sys.exits if it cannot find it — so an empty section written the tidy way would have broken the next fold, at the moment someone was trying to land unrelated work.

Verified rather than reasoned about: folded a probe fragment against this exact structure and confirmed it lands in [Unreleased], above the released section, then reverted it.

Suggested sequence from here

1. changelog: fold the five accumulated fragments into [Unreleased] #560 merges (fold).
2. This merges.
3. Tag v0.1.0-rc1. Its only job is to exercise docker.yml's tag path, which has never executed — the :${ver}-${arch} push and the version-tag stitch are gated on refs/tags/v*, and this repo has no v* tags. The last time never-executed publish code ran here it was ci: fix the multi-arch manifest check, which failed a correct manifest #559, where a gate failed a correct manifest.
4. If the rc publishes clean, tag v0.1.0.

The rc is disposable; a bad v0.1.0 on a public repo is not.