docs(changelog): release v0.21.0

Roll the Unreleased section into 0.21.0. As with 0.20.0 the section was
both misshapen and incomplete: 15 flat bullets, no headline and no
sections, against 126 feat/fix commits since the tag.

Thirty-eight new grouped entries cover what had no entry -- the
def-driven widget work (#1036), message definition collections (#272),
mxcli brain, the #1018 documentation carry across all 29 doctypes,
member resolution in check --references, the OQL name checks, SQL
referential actions, and the security items (os.Root extraction,
GO-2026-6303, the CodeQL redirect alert). Every pre-existing bullet is
carried verbatim.

The headline leads with the widget work, which is the release's largest
theme by some distance -- 46 commits touching widget code and ~11.2k
insertions, against ~3.8k for message definitions, the next largest.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ako