release: prepare DevKit 1.1.3

[Ayleovelle]

Summary

• Prepare all version, lockfile, bilingual README, changelog, and primary-artifact surfaces for DevKit 1.1.3.
• Add canonical exact-key, path-free storage intents; bind byte/file budgets and complete target descriptors into Fast Lane wave/profile evidence without letting DevKit select a path or claim a lease.
• Harden legacy runtime-store migration so schema shape, metadata, content addresses, acceptance identities, and Atlas outbox/finalization bindings are proven before current DDL runs.
• Carry bounded storage-profile and admission evidence over the private Host bridge while keeping the legacy pre-Host skeleton and public dispatch batch storage-intent-free and fail-closed.
• Preserve Fast Lane proof and tool-MCP recovery gates already on main: typed dispatch narrowing, exact Fast Lane/project-index formatting and contracts, exact agents/openai.yaml metadata allowance, and event-driven Windows pipe plus transport-FD-scoped behavior.

Host compatibility boundary

• Compatible, buildable Host source is on Ayleovelle's user-fork codex/host-1.1.3-storage-governance-upstream branch.
• The immutable source reference is c3dde23bec21c45d10740f2eec09d9a1b87cd329.
• This is not merged into OpenAI upstream and is not shipped or activated by this plugin. A stock Codex Host without the attested protected broker remains fail-closed with FASTLANE_HOST_AUTHORITY_UNAVAILABLE / NO_SAFE_WORK.
• Final protected-broker compile, probe, and runtime receipts remain Host-side release evidence, not a DevKit or upstream-support claim.

Focused release gates

• Exact 28-commit replay completed without conflicts; all original/replayed patch IDs match.
• uv lock --check: resolved 47 packages.
• Release static gate: Ruff check passed; 12 files formatted; Pyright reported 0 errors, 0 warnings, 0 informations; server.py compiled.
• Changed Python source gate: Ruff check passed; 11 files formatted; all 11 sources compiled.
• Storage firewall/runtime composition: 92 passed.
• Fast Lane release contracts: 173 passed, 271 subtests passed; Ruff, format, and syntax checks passed.
• Metadata, release workflow, plugin packaging, and primary artifact: 37 passed, 2 platform skips, 8 subtests passed.
• Host adapter: 36 passed.
• Windows relay/runtime registry: 36 passed, 2 platform skips; Windows named-pipe cases executed.

The full MCP suite and Linux publisher contract remain CI gates. This PR does not create a tag, publish a release, or merge itself.

[sourcery-ai]

Sorry @Ayleovelle, your pull request is larger than the review limit of 150,000 diff characters