docs: backfill CHANGELOG entries for v11 breaking changes + GlobalTool→Cli migration guide

[ChrisonSimtian]

Why

Two follow-ups noted in #220's body but not done in that PR — closing them out so the v11 record is complete.

What's in this PR

`CHANGELOG.md` — three new entries under `[Unreleased] — 11.0`, most-recent first:

• fix(security)!: AES-GCM v2 secret format with per-secret salt+nonce, 600K PBKDF2 (#212) #214 AES-GCM v2 secret format for `EncryptionUtility` — per-secret salt + nonce, 600K PBKDF2-SHA256 iterations. Existing `v1:` values still decrypt; new encrypts emit `v2:`. Migration is implicit (re-run `fallout :secrets` and any touched secret upgrades in-place).
• chore(globaltool)!: rename Fallout.GlobalTool → Fallout.Cli #206 `Fallout.GlobalTool` → `Fallout.Cli` package rename. NuGet package ID changes; command name stays `fallout`.
• feat(globaltool)!: PR-B — thin shims + local tool manifest + workflow regen (#203) #204 Thin shims + `.config/dotnet-tools.json` manifest + `[GitHubActions]` generator now emits the three-step `setup-dotnet` → `tool restore` → `dotnet fallout` shape. `build.cmd` removed from the scaffold.

`docs/migration/from-globaltool-to-cli.md` — new focused migration guide covering:

• The three consumer scenarios (global install, local `dotnet-tools.json` manifest, thin/fat bootstrappers, direct `dotnet fallout` in CI).
• Affected-versions table — `Fallout.GlobalTool` frozen at `10.3.40` (now unlisted), `Fallout.Cli` active at `11.0.x`, the `10.3.41-47` `Fallout.Cli` range also unlisted.
• Why-the-rename context + "stuck on 10.3.40" path.

Modelled on the existing `docs/migration/from-nuke.md`.

Test plan

• CI green (`docs/**` + `CHANGELOG.md` are both in `paths-ignore` so this should fire the docs-noop workflow only).
• Falloutdocs picks up the new migration page on next deploy (24h schedule or manual dispatch).