chore(release): promote v0.5.3 to main

[Baziar]

Curated promote from staging ref 0.5.3.

This PR is built from rapidkit-core/main plus selected source commits.
It does not inherit staging-only release workflow history.

Source

• Source base: 2529eeabd3aeff807c2148cc7d60f9f2d94f206c
• Source head: fe17f029b51f4b1b97d41b3afcb6e021ee32b9e0

Included commits

• 1e1613e1c7f2 fix: enforce module-owned generated paths
• 0c4b3ac52ab3 fix: align module test artifacts with owned paths
• f0db77ae0186 fix: curate staging promotion into public core
• 8245c11601b3 chore: align module docs domain
• bf5b2aad605f chore: sync module metadata after docs domain update
• e18b04679f64 chore: investigate free/ai/rag_pipeline stabilization (logs + tests)
• 23ecd477c406 chore: investigate free/ai/rag_pipeline stabilization (logs + tests)
• d8ec65030139 chore: add generator contract tests and module metadata updates
• 16a23751d439 chore: add generator contract tests and module metadata updates
• bbe759dc1756 fix(release): persist promote manifest and harden stable tag
• 56e6b195fdf7 fix(release): anchor promote chain to staging tags and source.json

Excluded commits

• 968ac3613a89 fix: validate staging promote token before tagging (protected workflow-only commit)
• 54d03752f2a0 fix(ci): pass SOURCE_REF env to curated promote step (protected workflow-only commit)
• 8b7c59fa2477 feat(ci): optional publish input for RC tag; pass SOURCE_REF (protected workflow-only commit)
• a9f3b6e7dfb6 fix(release): exclude protected paths at patch generation (protected workflow-only commit)
• 7097d0e01290 fix(ci): always use promote tooling from main when promoting a tag (protected workflow-only commit)
• 0035d1c25248 fix(release): skip engine-only modified/deleted paths in curated promote (protected workflow-only commit)
• 3c00d4e007b4 fix(release): exclude tier-owned files from promote (protected workflow-only commit)
• 6b6e6840642b fix(release): force-add promote manifest past target gitignore (protected workflow-only commit)
• fe17f029b51f feat(release): redact engine repo and auto-snapshot changelog (empty after protected-path restore)