chore(changelog): draft pending entries [skip ci]

CHANGELOG_PENDING.md

@@ -29,3 +29,9 @@
 ## 2026-07-07
 
 {"d":"2026-07-07","t":"SEC","m":"Injection-defense: backport Magatama core hardening into the gateway rule-layer, keeping pattern ids in lockstep for cross-layer telemetry. (1) FIX latent dead ignore-ru pattern — JS \\b is ASCII-only and never matches around Cyrillic, so the Russian 'ignore previous instructions' pattern never fired; removed the leading/trailing \\b. (2) ADD normalizeForScan de-obfuscation pre-pass (NFKC; strip zero-width/bidi/unicode-tag/combining; map Cyrillic+Greek homoglyphs->ASCII; collapse spaced-out letters; de-leet). scanForInjection now scans BOTH raw and normalized input and unions matches by id; new viaNormalization flag on InjectionScanResult. (3) ADD excessive-letter-spacing pattern (high) and broaden repeat-words-above (stacked determiners), ignore-zh (mid-phrase 所有), ignore-ko (모두/모든/전부 before verb). BLOCK-MODE FP GUARD: the gateway blocks (INJECTION_DEFENSE_MODE=block), so excessive-letter-spacing diverges from the Magatama regex by a letter-guard lookahead requiring >=3 consecutive spaced letters — the raw Magatama form would 422 legit numeric traffic ('what comes next: 1 2 3 4 5 6 7 8 9 10'). Same id+severity -> telemetry stays in lockstep. VERIFIED: 76/76 red-team + benign dev/ops FP battery against built dist; 10/10 new vitest cases; live /v1/guard/scan before/after (RU clear->blocked, homoglyph/spacing/ko blocked, numeric sequence stays clear); gateway rebuilt + restarted (pm2 llm-gateway id 24), health 200, 0 new false positives. Source of truth: magatama packages/core/src/security/injection-scan.ts (Gitea rene/magatama e8afd3b)."}
+
+## Pending -- 2026-07-18
+
+### Added
+- proxy subscription clients through gateway
+