docs(changelog): v0.59.0 audit fixes (CTRL-001, CTRL-T2-1, H10, M2)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,34 @@
 ## Changelog
 
+### v0.59.0 — security/crash-safety fixes from the 2026-06-13 audit (2026-06-13)
+
+Fixes the validated findings from the deep-sweep audit + BUGHUNT reconciliation
+(records under `felhom.eu/documentation/audits/`). All shipped with permanent
+regression tests.
+
+- **CTRL-001 (path traversal on `.fab` import) — High.** `appexport.UnmarshalManifest`
+  did zero validation; the attacker-controlled `manifest.AppName` / `HDDSubdirs` /
+  `VolumeNames` reached `filepath.Join`+`MkdirAll`/`extractTar` (restore.go:339/606/678),
+  so `../..` in any escaped the stacks / HDD destination dir (arbitrary write as the
+  controller). New `appexport.ValidateSegment` + `validateManifestPaths`;
+  `UnmarshalManifest` now fails the parse on a traversal segment, with defence-in-depth
+  guards at the HDD-subdir and volume-name join loops. `ConfigFiles` intentionally not
+  validated (holds dotfiles, never used in a restore join).
+- **CTRL-T2-1 (ghost-deployed stack on crash) — High.** `DeployStack` wrote `app.yaml`
+  `deployed:true` to disk *before* the async `docker compose up -d`; a crash during the
+  image-pull window left a ghost-deployed stack with no containers that the app then
+  refused to redeploy. The env is now persisted `deployed:false` (transitional) and
+  flipped to `deployed:true` by `runComposeDeploy` only after `up -d` succeeds. The
+  in-memory flag still goes true during the pull (no stale "Telepítés" button).
+- **H10 (plaintext secret on encrypt failure) — fail-closed.** `SaveAppConfig` logged a
+  WARN then fell through to persist the secret in plaintext on a `crypto.Encrypt` error.
+  Now returns an error instead — never writes plaintext.
+- **M2 (misleading lock).** `backup.Manager.SetStackProvider` was mutex-guarded while all
+  reads were unlocked; it is init-only (one call before any goroutine), so the lock was
+  removed and the contract documented. No behaviour change.
+- **AGENT-001 (wrong-disk wipe race)** is fixed on the agent branch `fix/agent-001-wipe-durable-reresolve`
+  (PENDING REVIEW — not deployed; stored out-of-band per the supervised-merge rule).
+
 ### v0.58.0 — infra-protection prevention layer for the OS/Docker-data split (2026-06-13)
 
 Phase 2 of the storage-split slice (Phase 1 = felhom-agent golden + provision). The OS rootfs and