Production hardening: correctness, verification and release gates

[dharan1007]

What changed

This hardening branch converts the audit findings into code changes rather than documentation-only fixes.

Current scope includes:

• repaired build/UI packaging and release scripts
• real CI verification gate
• dependency-first typed topological planning with regression tests
• fail-closed file sandboxing and context-validated git apply patch transactions
• fail-closed TypeScript validation
• corrected incremental/full scan semantics
• durable scan hashes, deleted-file pruning, graph-consistent single-file refresh and code-body embeddings
• unified .cos/cos.db state for orchestrator/RAG
• model-specific provider instance caching
• repaired recurring failure memory
• main agent success now requires post-mutation verification evidence
• autonomous write/patch operations are recorded in durable change history
• checkpoint resume restores the original task and message history and no longer marks partial work finished

Why

The audit found several cases where a feature existed but its strongest correctness claim was not actually guaranteed: inverted topology, stale patch application, fail-open validation, split state databases, incomplete checkpoint restore, missing durable scan hashes, and unconditional agent success. These changes make those paths fail closed and establish CI as the release authority.

Validation

This PR intentionally remains draft until GitHub Actions completes npm ci, typecheck, build, Node integration tests, and npm pack --dry-run. Any failures found by CI will be fixed in this branch before it is marked ready.