Test-first Chef cookbook change flow: Test Kitchen red/green workflows, semver bump and CHANGELOG, bchef policy lockfiles, and a gated GitLab merge request.