Define releases and harden retained Codex sessions

[Dastari]

Summary

• define the Git-only workspace release and package-versioning process
• harden retained Codex app-server creation, activation, resume, warning, notification, interruption, and deletion lifecycles
• add a closed, factory-attested dynamic-tools-only launch profile
• project canonical generated GraphQL tool schemas into the strict Codex subset without duplicating authority
• bind compile-time-static bootstrap instructions across empty-thread creation, durable activation, and resume
• bump graphql-orm-ai to 0.75.0; AI schema module remains 0.55.0

Verification

No GitHub Actions result is relied upon. Local validation includes:

• full multi-provider graphql-orm-ai matrix
• Codex-focused suite: 207 passed, one credentialed live test ignored
• exact non-Codex companion provider matrix: 237 passed, one explicit live test ignored
• warnings-denied Clippy and Rustdoc
• PascalCase GraphQL contract
• PostgreSQL and warnings-denied MSSQL compile lanes
• disposable PostgreSQL parity
• SemVer, release-policy, release-state, documentation, inventory, dependency and formatting checks

Documentation impact

• Documentation updated
• No documentation impact

Explanation: Updated the canonical release process, migration guide, changelog, implementation status, provider-session guidance, capability matrix, package inventory, README examples, and active readiness plan. Documentation remains project-neutral.