docs: record the CI failure and the macOS wiring in CHANGELOG and HANDOFF

The 5.2.0 changelog described the IronVault feature and the tuning loop and
said nothing about the week the pipeline spent red or the seven defects
found in it. A release note that omits the reason half the work happened is
not a record.

Adds to CHANGELOG: the CI story with all seven defects named, and the macOS
CPU/memory resolver wiring with the eight entities it fixed.

Adds to HANDOFF: "read CI before believing a green local run", with the
specific reason — three of the seven could not be reproduced on this machine
on principle (two needed a box with no GPU, one needed a Mac) and two more
lived in cfg(target_os = "linux") code a Windows compiler never reads. A
local cargo test says nothing about the other two platforms.

Open work 2 is updated rather than closed: the macOS readers now execute on
macos-latest, which is new, but plausible is still not correct and nothing
has compared them against Activity Monitor.

The prose was run past documentation_links before committing this time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>