docs(changelog): add the restore-from-Git entry (#2656)

    The branch had never added one, though the convention here is one bullet
    per PR in the same commit as the code.

    One entry for the whole feature rather than one per commit - it has not
    shipped yet, so the review rounds are refinements of an unreleased thing
    rather than fixes to a released one. For the same reason the per-category
    permissions are written as what to grant, not as something that changed.