security watch: remember a notice per group — a catalog pin and a DooPlex pin of one image no longer share one memory entry (old entries copied once, no re-mail); W13

scripts/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 2026-10-28 — the watch remembers a notice per GROUP: a catalog pin and a DooPlex pin of one image are two entries
+
+- **`security_watch.py`:** the memory key is `dooplex:<image>|<id>` for a DooPlex pin (`mem_image`), `<image>|<id>` as
+  before for the rest. Before, the catalog's RomM 5.4.1 and DooPlex's RomM 5.4.0 shared one key, `plan()` kept the later
+  item, and a new notice on both was mailed in ONE group's block only (the homelab session or the catalog work, never
+  both). A memory written before this is copied once to the DooPlex key, so the first night after the change mails
+  nothing again. Found while classifying the 20 runtime apps (R-1332); fixed in the session, no row.
+- Tests: `test_security_watch.py` W13 (5 checks; 4 red on the image-only key) — 64 checks.
+
 ## 2026-10-28 — the security watch reads zstd layers in CI by itself (R-1327)
 
 - **`image_runtime.py`:** zstd layers are decoded by `zstandard` 0.25.0 — an importable one, else the wheel pinned by