Record the catalog dedupe commands and the seed cleanup in the changelog

CHANGELOG.md

@@ -12,6 +12,21 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **`flask catalog dedupe`, `merge` and `rename`: catalog hygiene.** The legacy
+  data carried space-stripped twins - `DellInc.` beside `Dell Inc.`,
+  `Windows10` beside `Windows 10` - which rode into the shipped seed catalog
+  and out to every site that ran `seed catalog`. `dedupe` merges only
+  whitespace-and-punctuation twins, because those are one name typed two ways;
+  `Dell` and `Dell Inc.` normalise apart and are deliberately left alone, since
+  that is a naming choice only a person can make. The surviving row is the most
+  referenced, tie-broken toward the spaced spelling. `merge` makes that
+  judgment call explicitly and refuses to invent a target that does not exist.
+  `rename` fixes a stripped name with no twin, which neither of the others can
+  reach. All three report and change nothing unless `--apply` is passed, and
+  `dedupe` is idempotent. References are discovered from the live schema, not
+  listed in code: there are 15 foreign keys into these three tables, and
+  `machines.controllervendorid` is not one anybody would enumerate by hand.
+
 - **Secure Send: hand somebody a password without leaving it in a chat
   window.** A link in Tech Tools that carries one credential, dies when it is
   opened, and expires on its own if nobody opens it. The secret is encrypted in
@@ -75,6 +90,15 @@ ADR-007 and ADR-002.
 
 ### Fixed
 
+- **The shipped seed catalog contained duplicate vendors, models and operating
+  systems.** Four space-stripped twins, each with a correctly spaced original
+  already present, so a new site inherited the same company listed twice.
+  `OptiPlex5000` had no twin and was renamed to `OptiPlex 5000` rather than
+  dropped. Vendors 53 to 51, models 128 to 127, operating systems 14 to 12.
+  Not a code fault: the collector strips only leading and trailing whitespace
+  and treats the OS list as lookup-only, so it neither created these nor is
+  creating more. They came in with the classic-ASP import.
+
 - **A maintenance script could not find the database the site actually uses.**
   `python scripts/export_catalog.py` on a deployed site died with 1045 "Access
   denied for user 'root'@'localhost'", naming a user that site does not have.