fix: complete safe managed release upgrades

[yannickmonney]

Managed upgrades could discard rollback images, expose deployment-control routes or lose legacy execution evidence. Concurrent voice and automation calls could also pass project caps without reserving their pending usage. This change repairs these paths and prepares the complete v0.5.79 upgrade.

• Preserve held automation evidence during erasure, report partial deletion accurately and refuse organization deletion while a hold remains. Fence the released protocol-1 writers before cutover, with an all-organization zero census and recoverable refusal for unknown or occupied state.
• Remove host-wide image pruning, pin the sandbox permission helper by digest and refuse public deployment-control routes, including deployments under a URL prefix.
• Bound template recovery, Git acquisition and task occupancy reads. Keep task scope and exact requested-run identity, redact Git failures and include imported backend modules in CLI validation scopes.
• Prevent project-owned API keys from reading organization-wide knowledge while retaining their authorized project documents.
• Reserve voice and direct automation model usage under the shared budget lock. Capture projects at admission, including an explicitly empty project list, and retain those projects through refiling, installation changes, retries and settlement. Unknown outcomes retain a conservative estimate; watchdog recovery and settlement are idempotent.
• Moving a hidden conversation branch now clears its canonical root's project share. Moves and explicit sharing serialize against the current audience, and the audit records the root and original project. Destination members need a fresh explicit share.

Migration 0164 adds nullable attribution and reservation fields without inventing historical data. Legacy rows retain documented fallbacks; all old writers must leave before the new admission guarantees apply. Reserved estimates are not provider invoices or provider-enforced monetary ceilings. Erasure retires automation producers before removing model-operation identities and spend. A failed or held retirement reports Partial and preserves dependent accounting for retry; late settlement uses the erased-user pseudonym.

Includes reviewed component work from #4563, #4564, #4569, #4572, #4573 and #4579. Their PRs remain open until merged inclusion is verified. Published v0.5.78 artifacts remain unchanged. Ops has separately adopted the release source contract and provisioned the comment-intake workflow repair.

Validation: the real-PostgreSQL selected run passed 111/111 records, including all 37 budget, sharing and erasure cases, plus 8/8 prior-schema upgrade checks. The first run failed one stale assertion against refusal wording; after changing it to the exact structured refusal fields, the rerun passed. This is focused database evidence, not the full platform suite. Unit runs passed 442 budget checks, 45 sharing checks, 42 erasure/spec checks and 41 catalog/receipt checks; configured semantic checks passed. Documentation checks passed 685 tests, and changed EN/DE/FR pages were rendered at desktop and mobile widths. Independent review accepted the runtime repairs. Earlier component evidence includes authorization regressions, CLI scope guards, Caddy routing tests, PostgreSQL cutover/erasure probes and isolated released-container cutover.

Affected configured lint, formatting, conflict detection, release-note validation and whitespace checks passed. Configured SAST exited successfully with no reported findings; its engine partially analyzed lib/chat/turn.ts and the large backend/integration-check.ts, so this is not claimed as complete static analysis of those files. Separate semantic, native and independent code review evidence covers the changed paths. The merge with current main preserves every repaired runtime byte; the 67 CI-input guards, 1,520-box manual guard and release-source contract check passed, and independent composition review accepted both conflict resolutions.

Rebased onto latest main fc06dbf at the user’s explicit request to merge without waiting for CI. All 65 repaired runtime/docs/catalog files remain byte-identical; manual coverage follows main’s new per-suite files and retains every prior row. The manual and release-source contract checks passed after rebase. Hosted checks are pending and are not claimed green. Release candidate validation, immutable publication and deployment acceptance remain separate requirements.