Problem

CHANGELOG.md on main has two ## [Unreleased] sections:

• one at the very top with a single entry (perf(runtime): JSON-aware token estimation for tool paths #6281), and
• a second buried between released version sections (≈150 accumulated entries), positioned just before ## [2026.5.17].

The buried block predates #6281; #6281's merge added the top duplicate. Because the release tooling reads only the first ## [Unreleased] and silently drops the rest (the pre-commit guard warns about exactly this), those ~150 entries were stranded and would never reach release notes. The duplicate header also fails the ## [Unreleased] guard, which blocks every CHANGELOG-touching commit made through the git hooks (this is what stalled #5988 / #5980).

This is the same class of breakage the repo has fixed before ("Merge dual [Unreleased] sections", #4240 / #2282).

Fix

Consolidate both blocks into a single ## [Unreleased] at the top:

• Merge same-named ### subsections (collapsed 10 redundant subsection headers across Added/Changed/Fixed/Removed + the duplicate ## [Unreleased]).
• Every bullet preserved verbatim. Verified: the multiset of all non-header content lines is byte-identical before/after (3320 lines each, empty diff) — nothing reworded, truncated, or lost.
• Drop the two entries that are already published in released sections (so they are not re-announced next release): fix(installer): fall back to installable release, roll back bad upgrades #6272 (in [2026.6.22]) and fix(ci): pin vendored OpenSSL to Strawberry Perl on the Windows test lane #6171 (in [2026.6.17]). These were the only bullets whose canonical trailing (#NNNN) identifier also led a bullet in a released section; in-prose cross-references were excluded.

Net: one [Unreleased] at the top with 150 entries; released sections unchanged and correctly ordered.

Verification

• grep -c '^## \[Unreleased\]' → 1, and it is the first ## [ section (followed by ## [2026.6.22]).
• Content integrity: sorted non-header content lines identical to origin/main before the 2-entry dedup; after dedup, fix(installer): fall back to installable release, roll back bad upgrades #6272/fix(ci): pin vendored OpenSSL to Strawberry Perl on the Windows test lane #6171 remain present once each in their released sections.
• No new blank-line runs introduced (the single pre-existing triple-blank at [Feature] Declarative [[triggers]] in agent.toml (symmetric to cron_jobs) #5014 is unchanged).
• Pre-commit CHANGELOG guards (single [Unreleased], (@user) attribution) pass.

Note for maintainer

The deeper cause — why a buried [Unreleased] accumulated ~150 unreleased entries while releases were still being cut from the top — is in the release tooling, not this file. Worth a look before the next release so entries stop getting stranded. This PR restores a correct, releasable CHANGELOG; it does not change the tooling.