docs: postmortem + changelog for 2026-06-06 template/DHCP session

Postmortem of the Linux template deploy/prepare 'no IP' investigation:
separates the three distinct causes (apt index stale from --skip-update,
deploy --force snapshot-chain, wedged host vmnet-dhcpd) and documents the
recovery (restart vmware-networks). Changelog entry summarising the
toolchain, xvfb, --force cleanup and cloud-init seal changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/CHANGELOG.md

@@ -5,6 +5,30 @@ Open backlog items remain in [TODO.md](../TODO.md).
 
 ---
 
+## 2026-06-06 — Linux template: GUI toolchain, headless builds, deploy hardening
+
+- **Toolchain** (`Install-CIToolchain-Linux2404.sh`): new Step 4a installs
+  `python3-gi gir1.2-gtk-4.0 xvfb` (headless PyGObject/GTK4 GUI tests). Step 1
+  now always runs `apt-get update`; `--skip-update` only skips the full upgrade
+  (previously it skipped the index refresh too, so newly-added packages could
+  not be located).
+- **`build run` / `job`**: new `-Xvfb` / `--xvfb` switch (Linux only) runs the
+  build under `xvfb-run` so GUI toolkits get a `$DISPLAY`. Ignored for Windows.
+  See [WORKFLOW-AUTHORING.md](WORKFLOW-AUTHORING.md) §5/§8.2.
+- **`deploy-linux --force`**: now clears stale snapshot-chain artifacts
+  (`-NNNNNN.vmdk`, `.vmsn`, `.vmsd`, `.lck`) before the Step 4 resize, fixing
+  *"disk is part of a snapshot chain"*.
+- **`prepare-linux`**: Step 7d seals cloud-init (drops the stale
+  `50-cloud-init.yaml`, keeps the MAC-agnostic `99-ci-dhcp-allnics`, disables
+  cloud-init) so it never re-runs on linked clones; deploy user-data sets
+  `package_update/upgrade: false` and the Step 7 IP-detect timeout is raised to
+  600 s.
+- **Postmortem** [postmortem-2026-06-06-linux-template-no-ip.md](postmortem-2026-06-06-linux-template-no-ip.md):
+  intermittent deploy/prepare "no IP" traced to a wedged host `vmnet-dhcpd`;
+  recovery is `vmware-networks --stop/--start`.
+
+---
+
 ## 2026-05-13 — Sprint 16: Medium/Low hardening (final-master-plan)
 
 - **Watch-DiskSpace.ps1**: Event Log source renamed `CI-DiskAlert` → `CI-DiskSpaceAlert`