docs: document CI/CD pipelines, release flow, and v2.66.0 changelog

- CLAUDE.md: add CI/CD & Releases section with workflow table, tag
  patterns, Docker variants, beta/desktop release commands
- CONTRIBUTING.md: expand Releases section with standard (auto),
  beta (manual tag), and desktop release workflows
- docs/17-changelog.md: add v2.66.0 entry covering IDOR fix, BytePlus
  provider, per-agent grants, beta pipeline, and CI fixes

docs/17-changelog.md

@@ -4,6 +4,32 @@ All notable changes to GoClaw Gateway are documented here. Format follows [Keep
 
 ---
 
+## [v2.66.0] — 2026-04-05
+
+### Security
+- **Session IDOR fix**: All 5 chat.* WS methods (send, history, inject, abort, session.status) now verify session ownership. Non-admin users cannot read, write, or disrupt other users' sessions
+- **`requireSessionOwner` helper**: Extracted shared ownership check to `access.go` (DRY — pattern was repeated 9x in sessions.go)
+
+### Added
+- **BytePlus ModelArk provider**: Seedream image generation + Seedance video generation via BytePlus/Volcengine API
+- **Per-agent CLI grants**: Secure CLI binaries can now be granted/denied per agent with setting overrides
+- **Beta release pipeline**: `release-beta.yaml` — push `v*-beta*` tag from dev to create prerelease with Docker images + binaries
+
+### Fixed
+- **Scheduler test hang**: Defer ordering fix prevents CI timeout when test fails before unblocking goroutines
+- **Semantic-release branch**: `--no-ci` flag bypasses default branch check (repo default is dev, releases cut from main)
+- **OpenAI compat**: Together/Mistral reasoning, streaming, and vision gating; Mistral tool call ID normalization
+
+### Changed
+- **Docker builds**: Removed redundant `docker-publish.yaml` — `release.yaml` handles all Docker builds on release
+- **Desktop prerelease**: `release-desktop.yaml` auto-detects beta/rc tags and marks as prerelease
+
+### Refactored
+- **Web UI**: React-arch audit — RHF+Zod forms, Zustand persist, adapter layer, component modularization
+- **Desktop UI**: React-arch audit — schemas, RHF forms, file splits, services, store cleanup
+
+---
+
 ## [Unreleased]
 
 ### Added