docs(changelog): move the SSID-format contract entry to [Unreleased]

The wave-3 catch: the entry sat inside the frozen [v0.6.0-alpha4]
section (the tag exists); new entries belong in [Unreleased].

Author: Amperstrand

CHANGELOG.md

@@ -199,8 +199,22 @@ and [Semantic Versioning](https://semver.org/).
   when a future pin stops sending the MAC or drops those strings
   ([#536](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/536)).
 
-### Changed / Internal
-
+- **The open-AP SSID format is now a checked contract.** `99-tollgate-setup`
+  names the access point `<brand>-<4 hex characters>` (`TollGate-A1B2` for
+  the default brand) and puts that same name on both radios, so
+  `tests/contract/check-ssid-format.sh` — a CI gate, also wired into
+  `hooks/pre-commit` — now fails when that stops being true. It sources the
+  real `setup_public_wifi()` out of the script, runs it against a stub `uci`
+  and asserts the SSID it actually writes: both radios matching
+  `^TollGate-[0-9A-F]{4}$` for the default brand, one shared name, a
+  per-device 4-hex suffix. A second, structural layer checks the assignment
+  sites a checkout cannot execute — the same-version reinstall path recovers
+  its SSID from live config, and the whitelabel branch reads
+  `/etc/tollgate/brand` — so neither branch can quietly acquire a band
+  suffix. That suffix is the drift the test exists for: the Go side keys on
+  the `TollGate-` prefix (`discovery_log.go`, `vendor_element_manager.go`),
+  and `TollGate-A1B2-2.4GHz` would be a second network identity for the same
+  router.
 - **`getMacAddress`'s two lookup sources are package-level vars, so
   `/balance`'s session-bearing branch has unit coverage again.** The DHCP-lease
   and ARP paths were string literals, so off-router every `/balance` test landed