chore: update changelog for cpex host facade crate (#77)

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

CHANGELOG.md

@@ -23,6 +23,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 - CEL (Common Expression Language) policy decision backend. A new `apl-pdp-cel` crate registers `kind: cel`, letting authors write inline boolean predicates (`cel: { expr: ... }`) over the common attribute vocabulary (`subject.id`, `delegation.depth`, `session.labels`, ...), evaluated through the existing `PdpResolver` seam alongside Cedar, OPA, and AuthZen. Expressions compile once and cache by source; compile errors, undeclared-variable references, and non-boolean results fail closed (deny), overridable with `on_error: allow`. No change to APL evaluation semantics. (#68)
 - APL authoring ergonomics (backwards-compatible). The `apl:` wrapper is now optional — recognized APL terms (`policy`, `post_policy`, `args`, `result`, `pdp`, `session_store`) written directly on a section are honored, with the explicit `apl:` form still taking precedence. `run(name)` is accepted as an alias for `plugin(name)` in both policy steps and field pipelines. Unconditional `deny('reason')` / `deny('reason', 'code')` now parses as a bare action (e.g. in `on_deny:` lists), so a reason/code can be attached without a conditional. (#71)
 - Valkey-backed `SessionStore` for cross-node and cross-restart session label propagation. Selectable via a `kind: valkey` block under `global.apl.session_store` (factory pattern mirroring `pdp`), shipped in the `apl-session-valkey` crate and wired into `cpex-ffi` behind the optional `valkey` cargo feature (the default build and `.a` artifact are unaffected). Labels live in a Redis SET so appends are an atomic server-side union (`SADD`); the store is fail-closed (a load/append error denies the request rather than under-labeling), serves primary-only reads, supports an optional sliding TTL, requires TLS for non-localhost endpoints, and SHA-256s session ids out of the keyspace. When no block is configured the default remains the in-process memory store. See the operator runbook at `docs/operations/valkey-session-store.md`. (#74)
+- `cpex` host facade crate: a single dependency that re-exports the host runtime (`PluginManager`, `AplOptions`, `register_apl`) and the bundled plugin factories, each behind a cargo feature (`jwt`, `oauth`, `pii`, `audit`, `cedar`, `cel`, `valkey`). Hosts depend on `cpex` and enable the plugins they want instead of pinning `apl-cmf` / `apl-cpex` / `apl-pdp-*` / `apl-session-*` individually. `install_builtins(&mgr)` registers every enabled factory and installs the APL config visitor in one call; `register_builtin_plugins`, `builtin_pdp_factories`, and `builtin_session_store_factories` expose the pieces for hosts that assemble `AplOptions` themselves. (#77)
 
 ### Changed