docs(changelog): record credential-blind ingress (the claim handoff)

Slimmed on review: the entries describe only what PR #63 ships — the claim code,
the human fill, `psamvault pending` / `--cancel`, and the two refusals — and drop
`--wait`/`--timeout`, the file-migration flags and the `pending --code` view,
which move to a later PR. The dashboard entries are untouched: they belong to
the merged dashboard work.
