fix(ai): align maintenance auth type universe

[first-assist]

Outcome

Aligns the graphql-orm-ai 0.88 maintenance workspace with agql-auth 0.16.0 at exact revision 3bc38cd94794f1e868a9cc3a5551047b95a32105 so GEMA and graphql-orm-ai resolve one principal type universe. Releases graphql-orm-ai 0.88.3; schema module remains 0.63.0.

Security boundary

• preserves host-owned exact-only matcher policy introduced by agql-auth 0.16
• grants no AI resolver, tool, provider, egress, budget, or retention authority
• keeps one exact Git revision and updates the direct-host coexistence proof
• adds no path override, vendoring, or conversion shim

Verification

• graphql-orm-ai library: 317 passed, 2 reviewed live-Codex tests ignored
• direct-host backend coexistence fixture and one exact auth universe
• graphql-orm sqlite plus auth-agql and router auth-agql checks
• graphql-orm-ai SQLite, PostgreSQL, MSSQL, and all-provider checks
• warnings-denied package-scoped Clippy and Rustdoc
• cargo-semver-checks against a9f3299: 196 pass, 49 skip
• release, dependency, inventory, documentation, formatting, and diff gates

Documentation impact

• Documentation updated
• No documentation impact

Active dependency, bridge, migration, implementation-status, and agent handoff guidance now names the 0.16 exact revision. Historical release records retain their original pins.