docs(changelog): record #600 and #602 in the 3.5.0 section (#603)

* docs(changelog): record #600 in the 3.5.0 section

#600 merged into main while the release PR was open, so the 3.5.0 section
went in without it. Nothing in that PR touched the CHANGELOG, and no check
covers "everything merged since the last tag is written down", so tagging
v3.5.0 as main stands would ship the standings-endpoint fix undocumented.

The entry goes under Sports data, next to the other ESPN fetch changes, and
is written from the commit: what the old order did, why a college league's
200 defeated the 404 fallback, and what is now treated as routine.

No version change: 3.5.0 is not tagged yet, so this belongs in that section
rather than a new one. `scripts/check_release_version.py v3.5.0` still passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rqzd6Nz2bQJp5K7DD5dS4X

* docs(changelog): record #602 in the 3.5.0 section

#602 merged into main after #601, the same way #600 merged during it, and
also touched no CHANGELOG. So the section was still a commit short of what
v3.5.0 will actually ship.

It gets its own "Installers" subsection rather than a line under "Small
fixes": a malformed drop-in in /etc/sudoers.d makes sudo refuse every command
for every user, which on a headless Pi is unrecoverable over SSH. That is not
a small fix, and someone reading the release notes to decide whether to update
should see it.

Written from the commit: what both installers did, what `visudo -c` now gates,
and the fixed /tmp path that mktemp replaced.

`scripts/check_release_version.py v3.5.0` still passes, and this branch is
rebased onto 967f3a05 so the section now covers every commit since v3.4.0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rqzd6Nz2bQJp5K7DD5dS4X

---------

Co-authored-by: Claude <noreply@anthropic.com>

CHANGELOG.md

@@ -125,6 +125,19 @@ New modules a plugin may import via `src.*` (floor on 3.5.0):
   fetched, which keeps the peak memory of a four-capped-month fetch to about
   16 MB over the sequential path rather than 43 MB — `docs/LOW_MEMORY_BOARDS.md`
   puts a 1 GB Pi 3B+ at under 200 MB of headroom.
+- `ESPNDataSource.fetch_standings` asks each league the endpoint that league
+  actually publishes. It tried `/standings` first whatever the league and fell
+  back to `/rankings` only on a 404, but college leagues answer `/standings`
+  with a 200 that carries no poll, so the fallback never fired: the rank badge
+  simply never appeared and anything keyed off rankings quietly did nothing.
+  Endpoints are now ordered by whether the league publishes a poll, and a 200
+  that lacks the key counts as a miss, so a league answering both still ends up
+  with whichever carries the poll. Only a 404 is routine — that is how a league
+  says it has none; a connection error, a timeout or an unparseable body is
+  logged as an error again, and a bug raised while inspecting the payload is no
+  longer swallowed as a missing poll. This is the implementation the football,
+  baseball and hockey boards already ship; core was the last copy on the old
+  one.
 
 ### Scrolling
 
@@ -354,6 +367,19 @@ New modules a plugin may import via `src.*` (floor on 3.5.0):
   budget, so a rollback finishes inside the unit's 30-minute limit instead of
   being killed mid-way.
 
+### Installers
+
+- The generated `ledmatrix_web` sudoers rules are parsed before they are
+  installed. Both installers built the drop-in from `which` lookups and copied
+  it into `/etc/sudoers.d` without ever checking it, and a malformed file there
+  makes sudo refuse every command for every user — on a headless Pi, that is
+  unrecoverable over SSH. `first_time_install.sh` now runs `visudo -c` on the
+  generated file and, if it does not parse, prints what visudo said and leaves
+  the installed file untouched instead of replacing it with a broken one;
+  `configure_web_sudo.sh` does the same before offering the rules for
+  confirmation. `first_time_install.sh` also built that file at a fixed `/tmp`
+  path as root; `mktemp` now picks the name.
+
 ### Small fixes (update-all, plugin system settings, scripts)
 
 - **Check & Update All** counts a plugin that had nothing to update as