Complete Appraise 0.5 release readiness mitigation

[jamil2018]

Summary

Implements the complete repository release-readiness mitigation plan for Appraise 0.5 across phased, reviewable commits.

• closes A-01 through A-03 with loopback-only application/MCP boundaries, authenticated bounded HTTP ingress, and reference-only environment secrets
• centralizes test-run terminalization and adds fault-injection/idempotency coverage
• expands release CI, package publication checks, generated-artifact policy, dependency audits, and quality ratchets
• decomposes the MCP registry and the application coordinator/test-run/sync/plan-review hotspots
• adds bounded pagination, bounded log tails, index migrations, and query-plan benchmarks
• makes lifecycle documentation and coordinator references canonical and generated
• removes tracked runtime/build/test artifacts and synchronizes the scaffold from root source
• records the final release evidence in docs/release-evidence/2026-07-16-release-readiness.md

Validation

• npm run release:check
• npm run validate — 205 Vitest files / 892 tests; 38 Playwright tests
• npm run build
• npm run lint
• npm run check:harness
• npm run quality:fallow:release
• npm run quality:react-doctor:ci
• appraisejs package tests, stdio/HTTP MCP E2E, and build
• create-appraisejs template sync, 65 tests, and build
• all three production npm audits: 0 vulnerabilities
• Gitleaks branch scan: 21 commits, no leaks
• package tarball, generated-artifact, documentation-link, Graphify, and repository query-plan checks

Notes

The seven existing Turbopack broad dynamic-path warnings remain non-fatal. User-owned untracked Appraise plan artifacts and the local Graphify vocabulary cache were preserved and are not part of this PR.