add OpenBSD TA constraints and localhost TLS examples

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## 0.1.0 — Unreleased
 
+- Vendor five OpenBSD TALs and constraints with pinned provenance; enable policies
+  in both all5 Compose examples and add the TOML `ta-constraints-enabled` switch.
+  Validation summaries identify applied policies.
 - Breaking CLI change: mandatory TOML via `validate|daemon --config FILE`;
   remove business flags, `--` forwarding and logging environment overrides.
 - Read-only configuration checking/printing and top-level version output.