Promote dev to main: scanner recovery and strategic readiness hardening

[laclance]

Release promotion

Promote reviewed dev into default main for the next release (v1.0.14). Preserve dev squash-only history by using a merge commit for this dev -> main promotion; do not squash or back-merge main into dev.

Included fixes

• Fix malformed recovery outputs in scanner action #190 — Emit separate GITHUB_OUTPUT recovery lines, preserving post-delivery save-failure recovery classification.
• Hold corroborated upstream Go tool behavior from strategic queue #191 — Hold strategic issues independently reproduced as upstream Go-tool behavior with no project-local fix.
• Hold unapproved architectural feature proposals before recommending work #192 — Hold unapproved architecture/interface feature proposals, including proxy-controlled log-label trust changes.
• Prevent negated maintainer readiness from approving strategic issues #193 — Prevent negated maintainer readiness statements from being treated as approvals; preserve later explicit maintainer decisions.
• Avoid treating existing proxy-header regressions as feature proposals #194 — Distinguish new proxy-header features from existing-header regression bugs.

Verification

All five constituent PRs passed four GitHub Actions checks before squash merge into dev; the merged dev commit's checks should be green before promotion. No private instance changes or release publication are part of this PR.

Branch policy

Merge commit promotion only. Never merge main back into dev for ancestry.