Boron Context v0.7.5: add held-out continuity gate

[kforris]

Summary

• add a versioned synthetic, secret-free held-out continuity suite
• gate recall@5, MRR, relevant fixture source coverage, and zero wrong-project retrieval/writeback against minimum and frozen baselines
• share the production writeback scope guard with the evaluator and exclude explicitly cross-project evidence before ranking
• publish the 0.7.5 evaluation contract, release notes, and package/runtime/plugin versions

Local verification

• npm run check — 63 passed, 11 environment-skipped; eval passed 6 cases
• npm run format:check
• temporary PostgreSQL 17 migrations + npm run test:postgres — 11/11
• npm audit --omit=dev --audit-level=high — 0 vulnerabilities
• swift test --package-path apps/BoronMenuBar — 5/5
• swift build -c release --package-path apps/BoronMenuBar
• npm pack --dry-run --json

Boundaries

This does not authorize public release, Marketplace submission, paid activity, or marketing. Fixture source coverage is reported separately from live source-estimate coverage. Installer lifecycle, live source coverage, and the formal RC checklist remain separate gates.