docs/changelog.json is missing 2026.4.4 and 2026.4.5, so `h2 upgrade` cannot offer them

@shopify/hydrogen 2026.4.4 and 2026.4.5 are published to npm, but neither appears in docs/changelog.json. Because that file is the only source hydrogen upgrade consults, the CLI cannot see either release.

Impact

A merchant on 2026.4.3 who runs shopify hydrogen upgrade today is told they are on the latest version, while two patch releases — including two customer-account authentication fixes — sit on npm.

upgrade.ts builds the upgrade list by filtering releases from this file:

const availableUpgrades = releases.filter((release) => {
  const isUpgradeable = isUpgradeableRelease({release, currentPinnedVersion, currentDependencies});
  ...
});

A version absent from changelog.json therefore does not exist as far as the CLI is concerned. Simulating that filter against the current file:

on 2026.4.3:  offers = none
on 2026.4.4:  offers = none

The fixes currently unreachable via h2 upgrade:

Steps to Reproduce

# Published on npm
npm view @shopify/hydrogen versions --json | jq -r '.[] | select(startswith("2026.4"))'
# 2026.4.0 2026.4.1 2026.4.2 2026.4.3 2026.4.4 2026.4.5

# Documented in changelog.json
jq -r '.releases[].version' docs/changelog.json | grep '^2026\.4' 
# 2026.4.3 2026.4.2 2026.4.1 2026.4.0

Expected Behavior

Every version published to npm has a corresponding entry in docs/changelog.json, so h2 upgrade can offer it.

Actual Behavior

changelog.json stops at 2026.4.3. The last update was #3788; releases #3791 (2026.4.4) and #3912 (2026.4.5) merged and published afterwards without a matching changelog entry.

Why this happened

Updating changelog.json is a manual post-release step (documented as such in the hydrogen-release-process skill: "Without this step, developers cannot upgrade using the CLI"), and nothing in CI verifies it was done. It has now been missed twice in a row.

One contributing wrinkle: PR #3844 is titled [ci] release 2026.4.5 but did not bump @shopify/hydrogen (it stayed at 2026.4.4 in that commit) — the actual 2026.4.5 bump landed later in #3912. Anyone reconciling releases by PR title alone would attribute 2026.4.5 to the wrong commit.

Suggested follow-up (separate from the immediate fix)

A CI assertion that max(changelog.json releases) >= templates/skeleton/package.json version would have caught both misses at release time. Happy to open that separately if it's wanted — this issue is just about the two missing entries.

I have a PR ready that adds both entries.

Start with docs/changelog.json and compare its existing release entries with the 2026.4.4 and 2026.4.5 changes listed here. Check packages/cli/src/commands/hydrogen/upgrade.ts to confirm how releases are filtered, then use jq to verify both versions appear and are offered for a project on 2026.4.3.