chore(release): add release safety guardrails

[sumfxn]

What

Adds release-safety guardrails before any npm publish:

• gates the release workflow behind vars.RELEASES_ENABLED == 'true'
• disables Changesets version/tag churn for private packages
• moves @usdh-kit/sdk from widget peer dependency to widget runtime dependency (workspace:^)
• updates widget install docs so consumers do not install the SDK unless they use SDK APIs directly
• includes package-local LICENSE files in SDK/widget npm tarballs
• updates the roadmap status for landed Track 1 and in-review Track 2

Why

The previous generated release output proposed an unintended widget major and private package churn. This PR makes the release path opt-in and keeps the next generated release PR reviewable before any npm publish.

Validation

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm lint
• pnpm build
• pnpm typecheck
• pnpm test
• git diff --check
• pnpm changeset status --since=origin/main
  • release-safety alone: SDK patch, widget patch, no minor/major
  • simulated with feat(sdk): add outcome market reads #51 merged: SDK minor, widget patch, no major
• pnpm --filter @usdh-kit/sdk pack --pack-destination /private/tmp
• pnpm --filter @usdh-kit/widget pack --pack-destination /private/tmp

Release

No npm publish from this PR. The release workflow remains disabled until the repo variable RELEASES_ENABLED is deliberately set to true, and any generated release PR still needs manual diff review before merge.