docs(changelog): v0.60.0 — M25 data-race fix; M18/M19 branched

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,21 @@
 ## Changelog
 
+### v0.60.0 — M25 data-race fix (backlog-Medium cleanup) (2026-06-13)
+
+Backlog-Medium reconciliation from the 2026-06-13 BUGHUNT reconcile. M4/M5/M6 verified already FIXED
+(no action). M18 (dump re-validation every 5 min — perf) and M19 (naive `deriveStackName` misattribution
+— low-incidence correctness) verified LIVE but cross-package-entangled; prepared on branches
+`fix/m18-dump-validation-cache` / `fix/m19-stackname-crossref` (notes + fix plan, pending review, not
+deployed).
+
+- **M25 (Server.integrationMgr data race) — FIXED.** `NewServer` launches the `SyncFileBrowserMounts`
+  goroutine (which reads `integrationMgr`) from the constructor, *before* `main.go` calls
+  `SetIntegrationManager` — so the init-only happens-before that covers the other `Set*` fields did not
+  hold, making it a genuine data race (reads at `handlers.go:358/360/1433` vs the unsynchronized write).
+  Converted the field to `atomic.Pointer[integrations.Manager]`; setter `Store`s, all readers `Load()`.
+  Regression test reproduces the concurrent access and is clean under `-race` (verified on the build
+  server); it flags on the pre-fix plain-pointer field.
+
 ### v0.59.0 — security/crash-safety fixes from the 2026-06-13 audit (2026-06-13)
 
 Fixes the validated findings from the deep-sweep audit + BUGHUNT reconciliation