[codex] aaes-os production sweep

[warheart1984-ctrl]

Summary

• Adds the AAES OS production runtime sweep as a standalone TypeScript workspace.
• Implements the constitutional runtime surface: CEN hardening, transition validation pipeline, sovereignty ledger, invariant registry/IDSL, NIMF, constitutional evolution, evidence receipts, trust root, UCR attestation, stress harness, and operator console.
• Adds production hardening: docs coverage gate, readiness/security headers, static UI serving, file-backed ledger adapters, Vite proxy coverage, and endpoint/UI regression coverage.

Verification

• corepack pnpm test from E:\project-infi\aaes-os: package builds completed, Vite production build completed, 42 test files passed, 109 tests passed.
• corepack pnpm coverage:docs from E:\project-infi\aaes-os: recent document coverage check passed, 38/38 documents mapped.
• Ephemeral ops-console production smoke from services/ops-console: /readiness, /patches, /cen/events, /meta/law-of-laws, and / returned healthy responses with JSON/static UI checks.

Notes

• This PR branch is based on AAES-OS:main and mirrors the verified E:\project-infi\aaes-os project at the repository root.
• A separate temp-clone local install attempt hit a Windows pnpm workspace symlink EISDIR filesystem issue, so the authoritative verification evidence is from the original AAES OS workspace where dependencies were already installed and the exact source tree passed.