docs: add missing Unreleased changelog entries for merged PRs

[atc964]

Summary

The [Unreleased] section of CHANGELOG.md was missing entries for several changes already merged to main. This backfills them, written from the merged diffs, matching the file's existing format (section headings, hyphen bullets, present-tense behavior descriptions, PR/issue references). Docs-only; no code changes.

One note on scope: the requested list named #67, which is the issue, not a PR — the merged PR that fixed it is #72, so the entry cites both.

Entries added

• fix: enforce idempotency for change requests #64 (Fixed) — FD-12 idempotency enforced on POST /api/v1/change-requests: required non-empty idempotency_key (422 without it), identical replay returns the original change request, changed-payload reuse returns 409 idempotency_conflict; keys scoped per order, 24-hour TTL.
• fix: reject change requests for dealless orders #65 (Fixed) — change requests against an order with no deal reference now return 400 deal_id_required instead of an unstructured 500; new orders persist an empty-string deal_id and legacy null records are guarded on read.
• fix: hold the MCP session open in one background task, don't split enter/exit #66 (Fixed) — OpenDirect21Client no longer crashes ExecutionActivationFlow with anyio's cross-task cancel-scope RuntimeError when the MCP connection attempt fails: the streamablehttp_client/ClientSession lifecycle now opens and closes inside one background task; connection failure degrades to the REST fallback (issue Stale '@listen() CrewAI version mismatch' test stub hides zero coverage on discovery_inquiry_flow (execution_activation_flow has a real, different bug) #60 part 2).
• fix: hydrate approval resume via Flow._state, not the read-only property #72 / issue POST /approvals/{approval_id}/resume returns 500 for both approved and rejected decisions: assignment to read-only ProposalHandlingFlow.state #67 (Fixed) — POST /approvals/{approval_id}/resume no longer 500s after a recorded decision; resume hydrates the flow via the private _state attribute since CrewAI 1.15 made Flow.state a read-only property, and an empty snapshot no longer throws.
• fix: add --quiet to create-operator-key for scripting #80 (Added) — --quiet / -q on ad-seller create-operator-key prints only the minted key for scripting. Included rather than omitted: it is a user-facing CLI surface change with a doc update, and the changelog already records comparable CLI key-management additions (Cleans up operator key management #59 in 2.4.2).