Prepare workspace release with licensed auth and router notices

[first-assist]

Prepare the next immutable workspace release with MIT-licensed agql-auth v0.19.1 and a router archive that carries its third-party notice/source evidence. The verified auth tag resolves to 96bafbf21adbc7ad963729e1e981feaba5debe90.

• Record auth release tags and their exact locked commits in the workspace manifest; align the backend coexistence fixture with the same source.
• Finalize the existing AI 0.98.0 notes and update compiler/dependency guidance.
• Lock h2 0.4.16 and rustls 0.23.45 security fixes, including required rustls-webpki and AWS-LC updates.
• Reject a release environment that lacks Dastari reviewer protection.
• Package exact third-party notices, matching Rust standard-library notices, and 14 checksum-verified source archives with the Linux auth-enabled router. Bind supplemental notice URLs and hashes to the reviewed lockfile, SBOM component set and artifact profile.

Seven dependencies have license declarations but no recovered standalone notice file. Their source archives and explicit dispositions are retained for the designated owner review; the notice configuration does not grant distribution approval. The quick-xml/rsa advisory findings retain ADR-0008's existing execution restrictions.

Validation

All 66 local release commands pass, including every provider, test-owned SQLite/PostgreSQL/MSSQL lanes, Clippy, Rustdoc, SemVer and dependency trees. Release lanes use stable Rust 1.98.1; router MSRV/SemVer lanes use Rust 1.90.0. The subsequent packaging-only commit preserves that entire Rust package and Cargo.lock tree.

Thirteen notice-packaging regressions, six manifest tests, documentation, inventory, release state, package policy, actionlint and the clean tag-tree manifest preview pass. A local optimized router build passes its CLI contract; an archive check verifies the binary and every packaged notice/source hash. The local candidate requires at most GLIBC_2.38 symbol versions. Hosted CI and Managed SMB pass on final commit be29f48.

Existing versions were already advanced for this release. Immutable tags for unchanged storage, backup and protocol packages retain their original source trees. Before publication, configure the protected release environment and immutable releases, and retain the designated router distribution approval reference.

• Documentation updated
• Documentation not needed