Fix retained web-search resume on fresh actors

[first-assist]

Summary

Allow a freshly initialized Codex process actor to adopt the exact frozen web-search domain policy and call ceiling from a retained session while encoding thread/resume. Actors that already hold retained state continue to reject any policy or ceiling change.

This fixes a pre-dispatch rejection when a retained web-search-enabled thread is resumed in a new process. It does not change GraphQL SDL, persistence, authorization, or data migration behavior.

Verification

• Focused fresh-versus-bound actor regression test
• Full AI test suite with all provider features (423 unit tests plus integration suites and doctests)
• Warnings-denied Clippy and Rustdoc
• PascalCase naming test and Rustdoc
• Compile-only PostgreSQL and MSSQL lanes
• Documentation, inventory, dependency, release-state, release-manifest, package-release-policy, and SemVer gates
• Formatting, diff check, lockfile review, and committed-diff neutrality scan

Documentation impact

Check exactly one option and explain the result.

• Documentation updated
• No documentation impact

Explanation: bumped graphql-orm-ai to 0.95.13 and updated its README, changelog, migration guidance, implementation status, generated workspace inventory, and both lockfiles.