docs(changelog): mark the v0.3.0 behaviour and session-API changes as breaking (weekly review)

[flashduty]

Why

Weekly review (cat-fe SDK / component libraries, 2026-09-14 → 2026-09-21) of what shipped in v0.3.0.

Two of the changes in the v0.3.0 section alter the behaviour or the types an existing installation
already depends on, and neither carries the 💥 marker that this file's legend (CHANGELOG.md:5) defines
for a breaking change. The convention already exists in this file: v0.2.0 has a 💥 **Breaking** line
for a removed init option and a 💥 **Breaking for TypeScript code that implements our interfaces** line
for interface members gaining members.

What this PR changes

Documentation only — CHANGELOG.md, no source file.

1. startSessionReplayRecordingManually default flip. configuration.ts:482-488 now defaults it to
   false whenever remoteConfigurationEnabled is set, where it used to default to
   sessionReplaySampleRate === 0. An existing site with remote configuration on and an init replay rate
   of 0 — that is, a site that never passed the new options — starts recording on its own, and a console
   delivered rate now uploads and bills replays it previously only stored. The site has to change nothing
   to get that. It is currently logged as 🐛 alone, so a reader scanning for the breaking marker misses it.

2. SessionManager.updateSessionState changed shape. In @flashcatcloud/browser-core, v0.2.3
   packages/core/src/domain/session/sessionManager.ts:23 was
   (state: Partial<SessionState>) => void; v0.3.0 is
   (update: (state: SessionState) => Partial<SessionState> | undefined) => void. SessionManager and
   SessionState are both exported from that package's entry point (packages/core/src/index.ts:61,
   :133), so a consumer calling updateSessionState({ ... }) compiles under v0.2.x and throws
   update is not a function at runtime under v0.3.0.

   Blast radius is small: every in-repo caller was migrated (packages/rum-core/src/domain/rumSessionManager.ts:427,
   :448, :519), and the entry points a page bundle actually uses are unaffected. It is only the
   published @flashcatcloud/browser-core surface that moved.

Alternative to (2), for the owner to decide

If the object form is worth keeping for callers outside this repository, the change can be made
backward-compatible rather than documented as breaking:

updateSessionState: (update: ((state: SessionState) => Partial<SessionState> | undefined) | Partial<SessionState>) => void

with sessionStore.ts:224-229 narrowing on typeof update === 'function'. It also moves the signature
back towards upstream's, which is what the surrounding comments in that file say they want to preserve for
the next upstream merge. I have not opened that as a PR — it changes an exported signature in a published
package, and I could not run yarn typecheck / yarn test:unit here to verify it, so it is a call for
whoever owns the API.

Verification

Docs only, so nothing to run beyond CI's formatting check. prettier is not installed in the environment
this review ran in, so yarn format on CI is the check that matters; the added lines are ≤ 110 characters
and markdown proseWrap defaults to preserve, so no rewrapping is expected.