feat(ai): classify contained stateless native refusals

[first-assist]

Summary

• add a proof-bearing terminal contract for completed, metered StatelessReplay native-item refusals
• commit authoritative usage while preserving uncertainty for answers, tools, retained turns, incomplete streams, and protocol drift
• finish clean refusals as retryable Failed/provider_native_item_rejected
• release graphql-orm-ai 0.86.0 and graphql-orm-ai-tool-profiles 0.9.0 with migration documentation

Migration

The AI schema remains 0.63.0. There is no database, data, GraphQL SDL, protected-payload, backup, or restore migration.

Verification

• cargo check -p graphql-orm-ai --features provider-codex-app-server
• cargo test -p graphql-orm-ai --features provider-codex-app-server --lib: 310 passed, 2 ignored
• cargo test -p graphql-orm-ai-tool-profiles --lib: 26 passed
• affected-package Clippy with warnings denied and --no-deps
• Rustdoc with warnings denied for both affected packages
• cargo fmt --all -- --check
• python3 scripts/check-documentation.py
• dependency tree confirms tool-profiles 0.9.0 is the exact AI runtime dependency

Known pre-existing gate

Warnings-denied Clippy without --no-deps stops in unchanged graphql-orm-macros code on collapsible_else_if at operations.rs:4870. The affected packages pass the same gate with --no-deps.

Documentation impact

• Documentation updated
• No documentation impact

Changelogs, migration guides, install examples, implementation status, and generated workspace inventory are updated.