docs: finalize v0.3.5.2 release notes

RELEASE_NOTES.md

@@ -1,6 +1,10 @@
 # LOGAR Release Notes
 
-## [v0.3.5.2] - 2026-10-02
+## [v0.3.5.2] - 2026-10-03
+
+### 🚀 Fleet Hub Client Update Caching & Distribution
+- **Local Package Caching**: The Fleet Hub automatically caches edge client binaries and packages locally on startup and upon scheduled refresh, minimizing external upstream traffic.
+- **Edge Pull Mechanism**: Forwarder nodes retrieve validated update payloads directly from the local Fleet Hub.
 
 ### 🛡️ Windows Defender Firewall Automation (Fixes Issue #1)
 - **Automated Port Exemptions**: Inno Setup (`installer_server.iss`) and NSIS (`installer_server.nsi`) server installers automatically configure inbound Windows Defender Firewall rules for WebUI (`TCP 8443`) and mTLS log ingestion (`TCP 9443`).
@@ -15,6 +19,10 @@
 - **Automatic Key Invalidation**: Clicking "Download Client Config" (`GET /api/client/export-profile`) automatically generates a fresh enrollment secret and invalidates previous secrets, preventing reuse of leaked keys.
 - **WebUI Reset Shared Key**: Added "🔄 Reset Shared Key" controls in the WebUI header, Fleet tab, and Export Modal, backed by `POST /api/server/reset-enrollment-secret` to rotate keys and update quick-deploy command snippets on demand.
 
+### 🔒 Security Hardening & Modular Architecture
+- **Decoupled CI & Test Execution**: Clean modularization across server, client, and authority services with fully autonomous unit and integration test suites.
+- **API Robustness & Validation**: Added cryptographic CSR validation endpoints and request sanitization.
+
 ---
 
 ## [v0.3.5.1] - 2026-09-30