CHANGELOG: 0.8.43 was not published; notes move to Unreleased

CHANGELOG.md

@@ -3,8 +3,6 @@
 
 ## Unreleased
 
-## 0.8.43 · 2026-10-23
-
 - Ship-step contract for release pipelines (docs/ship-step.md): `play build | upload | release`, `apple build | upload | submit | resubmit` exit 0 ok, 1 failure, 2 usage, 3 needs the owner (with `error.code` and the console deep link), 4 store refused, 7 nothing to do; `--json` ends with exactly one result line on stdout, `--result-file` writes it atomically (also on failure), `--progress json` gives one JSON line per phase on stderr.
 - `--env-file <path>` loads KEY=VALUE secrets before the credentials resolve (POSIX: mode 600 or stricter) and every known secret value is scrubbed from stdout, stderr and the result file; `--version-from version.json` takes the version and build ({version, build}, {versionName, versionCode}, {marketing, build}).
 - Re-runs never upload twice: `play upload` with a versionCode Play has and `apple upload` with a build number App Store Connect has end with exit 7 and what is there; `play release` with the same release and `apple submit` of an already submitted build too.
@@ -20,6 +18,10 @@
 - Desktop: tabs in one row with a More menu, one Refresh, reviews keyboard (J/K, R, C, O), Settings and More tools search, sticky first column and compact density for wide tables, styled in-app dry-run preview before every write.
 - Checks: "Open guide" opens the matching skill for every finding.
 
+## 0.8.43 · 2026-10-23
+
+- Tagged but not published (CI red: scrub hits in test fixtures, a ship-step test); everything ships in the next version.
+
 ## 0.8.42 · 2026-10-23
 
 - Tagged but not published (generated API tables differed on Linux CI); everything ships in the next version.