docs: define Git workflow, versioning, and environment strategy

Add the canonical workflow reference (docs/WORKFLOW.md): branch model
(main/develop + feature/fix/hotfix), Conventional Commits, SemVer, tagging,
and the three-environment strategy (native dev, Docker staging, Linux prod).
Seed VERSION (0.1.0) as the single source of truth and a Keep-a-Changelog
CHANGELOG.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+All notable changes to InboxIntel are documented here. Format follows
+[Keep a Changelog](https://keepachangelog.com/); versions follow
+[Semantic Versioning](https://semver.org/). See [docs/WORKFLOW.md](docs/WORKFLOW.md).
+
+## [Unreleased]
+### Added
+- Formal Git workflow & environment strategy (`docs/WORKFLOW.md`).
+- Staging environment overlay (`docker-compose.staging.yml`) — production-shaped
+  Linux containers on Windows, isolated ports/volumes.
+- Version-controlled Git hooks (`scripts/git-hooks/`) + installer
+  (`scripts/install-hooks.ps1`): pre-commit secret/format checks, pre-push
+  build+test gate.
+- `VERSION` file as the single source of truth for the release number.
+
+## [0.1.0] — scaffold
+### Added
+- .NET 8 Clean Architecture backend (Domain/Application/Infrastructure/Api) + React/Vite SPA.
+- Docker Compose stack (Postgres 16, API, frontend, optional nginx proxy).
+- Gitea Actions CI (backend build+test, frontend build) on `main`/`develop` + PRs.
+- Security hardening: encrypted OAuth tokens, EF global query filters (IDOR),
+  loopback binds, non-root containers, SSRF egress guard.
+- One-command deploy scripts (`deploy/up.ps1`, `deploy/up.sh`).
+
+[Unreleased]: https://your-gitea-host/InboxIntel/compare/v0.1.0...HEAD