docs(changelog): the next cut is 0.24.0, and it absorbs the unreleased 0.23.3

[dmealing]

Documentation only. Reconciles the changelog so it declares one next version instead of two, and corrects three entries against what actually shipped.

The changelog declared two unreleased versions at once

## [Unreleased] held the cross-port sources work; a ## [0.23.3] PATCH entry sat below it holding the meta gen hand-edit fix. No registry ever carried 0.23.3 — npm, PyPI and Maven Central are all still on 0.23.2 / 7.23.2 (checked, not assumed). Both bodies of work ship together, and a release cannot be two versions at once.

It is 0.24.0, not 0.23.3, because two changes in the sources work are default flips rather than corrections: the Java mojo now fails a build that a silently-empty model used to let pass, and Java and Python now follow symlinked directories. Pre-1.0, ^0.23.x resolves <0.24.0, so a MINOR is adopted deliberately while a PATCH is taken automatically on a routine update — the same call, for the same reason, as 0.21.0. The 0.23.3 body is demoted to a section that says where it came from, so the number does not read as skipped.

This also matters mechanically. scripts/prerelease.mjs derives an RC's base from the topmost ## [x.y.z] header. Before this it would have produced 0.23.3-rc.N, and every invocation would have needed --base to be talked out of it — which docs/features/prerelease.md calls out as exactly how a version number gets burned. Verified after the fix:

released: 0.23.2   base: 0.24.0 (from CHANGELOG.md)   iteration: 2
npm 0.24.0-rc.2 · pypi 0.24.0rc2 · nuget 0.24.0-rc.2 · maven 7.24.0-rc.2

Three entries corrected against what shipped in #319

• The symlink bullet claimed a guarantee that was not true and was gated by nothing. "A symlink cycle is a loud error rather than a hang" was written before it was true, and it understated the C# failure: the enumeration swallowed the kernel's ELOOP and returned ~40 phantom copies of one file while reporting success. The entry now describes what actually happened and notes the claim is carried by a corpus case (a-symlink-cycle-is-an-error) rather than by prose. Two symlinks cases became three.
• The unknown-key bullet said .metaobjects/config.json rejects unknown keys, full stop. That is the Node CLI only — the other three ports read the neutral subset and ignore them. Now stated as the intended asymmetry it was ruled to be, including the consequence an adopter must plan for: a config written by a newer meta hard-fails an older one.
• meta init --print-only writing the files it previewed was undocumented entirely. Added, including that the dry run used to report in the past tense.

Not in this PR

No product code. The 0.24.0 header does not cut anything — the version bump, tag and publish remain a separate deliberate step, and the breaking batch (ADR-0052 + ADR-0053 + FR-037 R1/R2 + FR-038) is still not on main.

🤖 Generated with Claude Code