chore(release): cut v0.27.0 changelog entry - #827

Description

Cuts the 0.27.0 section of CHANGELOG.md. release.yml takes the GitHub Release notes from ## [0.27.0]; the tag follows once this merges and ci.yml passes on the merge commit.

• ## [Unreleased] → ## [0.27.0] — 2026-11-04, with an empty ## [Unreleased] above it. The compare links run to 0.27.0.
• Nine entries that parallel merges left under the wrong heading move word for word:
  • feat(databricks): bronze landing, retention, scoped grants and enforcement follow-ups #801's four Databricks fixes (fail-safe lock, paused job, stale masks, residency line): Removed → Fixed, next to the other Databricks fixes.
  • The trailing-newline entries of security: refuse a trailing newline in whole-string validators #797, security: schema validation let a value with a trailing newline through a pattern #799 and security: the ODCS and plugin-extension checks let a trailing newline through a pattern #811: Upgrade notes → Security, after the validate_ident entry.
  • fix(diff): close the --baseline gate gaps found while shipping #789 #805's "compared contracts that no schema accepts": Upgrade notes → Fixed, after the other fluid diff --baseline entries. Its "printed contract names raw" (terminal and Markdown injection): Upgrade notes → Security.
• Upgrade notes gain six pointers that restate what the entries already say: the retired provider names (feat!: retire redshift and datamesh-manager as providers #796, feat(providers): list providers without importing them, and reserve the built-in names behind an operator grant #812), plugin grants for built-in names (feat(iac): IaC plugins load on first use, and built-in platform names are reserved behind an operator grant #807, feat(providers): list providers without importing them, and reserve the built-in names behind an operator grant #812), Iceberg sink catalogAuth pairing (security(iceberg-sink): a catalogAuth variable reaches only hosts the operator paired it with #818), S3 state-lock permissions (fix(iac): lock OpenTofu state on S3, and release the lock on timeout #787), fluid diff --baseline exit codes (fix(diff): fluid diff --baseline sees the columns of a 0.7.x contract #789, fix(diff): harden the column type comparison behind --fail-on-breaking #802, fix(diff): close the --baseline gate gaps found while shipping #789 #805), and the 0.28.0 base-install change (feat: optional dependencies name their extra, and litellm/mcp/lineage extras ship alongside the base install #806).

The title uses chore(release):, as 0.19.0–0.23.0 did. forge_docs' check_cli_docs.py --refresh-releases finds a release only through a chore(release) commit, and 0.24.0–0.26.0 had none, so its reviewedThroughRelease is stuck at 0.23.0.

Since v0.26.0: lightweight CLI phase 1 (#790, #791, #796, #804, #806, #807, #812), the managed Flink to Iceberg preview in 0.7.7 with Kafka record shapes (#784), Databricks follow-ups (#778, #779, #780, #785, #801), fluid diff --baseline hardening (#789, #802, #805), Glue and BigQuery column types (#793), build-id refusals (#803, #808, #813), and security fixes (#788, #797, #799, #811, #814, #818, #820, #822, #823).

Type of Change

• Documentation update

Documentation

• No docs needed — this change does not affect user-facing behaviour
  • Justification: release notes only. The forge_docs pin bump follows the release, since forge_docs pins the CLI version.

Testing

• release.yml's own awk extractor, run on this file: 817 non-empty lines for [0.27.0], none for [Unreleased].
• The moves were checked by script: the multiset of non-blank lines was unchanged before the six Upgrade-notes bullets were added.
• detect-secrets 1.5.0 on CHANGELOG.md: clean. tools/product_guardrail/check.py (and --self-test): clean.