release: define showcase and owner acceptance gates

[KXHXK]

What changed

• Formally split Showcase Release from Product Release.
• Define this version as a public static showcase plus a locally reproducible complete Agent MVP and a 3–5 minute recording.
• Add an owner-only mastery and demo acceptance guide that Codex cannot auto-sign.
• Add the Apache-2.0 license.
• Align Docker uv with local/CI at 0.11.28.
• Expand repository safety scanning to bilingual public documents.
• Replace accumulated stale handoff/current-state snapshots with current authoritative facts.
• Update README, audit, daily log, and the 122-document index.

Why

The original gate mixed a portfolio showcase with a public interactive production deployment. This made the actual static public boundary look incomplete and left personal mastery unverified. The new gates preserve every Agent, reliability, evidence, and truthfulness requirement while keeping public-product controls explicitly closed.

Validation

• Targeted release/document/safety contracts: 30 passed.
• Ruff check and format: passed (216 files).
• mypy: passed (85 source files).
• Repository safety: passed.
• Document index: passed (122 current Markdown files).
• Complete backend suite with disposable pgvector PostgreSQL: 671 passed.
• Fixed three-business evaluation: passed.
• Frozen Agent safety/recovery evaluation: 9/9.
• Frontend: 19 files / 60 tests passed.
• Vite production build: passed.

Important boundary

The public Netlify site remains static. The complete FastAPI/LangGraph/FastMCP/PostgreSQL/Redis workflow is locally reproducible through Docker Compose. Product Release remains CLOSED. Final Showcase tagging must wait for the owner walkthrough, code explanation, recovery/idempotency experiment, and recording.

Local networking note

Git smart-HTTP was reset by the current network. The branch was created through GitHub's Git Data API only after the generated remote tree SHA exactly matched the local commit tree SHA. Local Docker image rebuild also timed out while fetching the uncached GHCR uv layer; the final container result must therefore come from the main-only Compose job after merge.