Promote protected release-evidence approval to main

[TheGreenCedar]

Summary

Promote the reviewed #1138 workflow correction so the protected release-evidence environment can supply exact-artifact exception approval. This changes only release workflow policy, its focused mutation test, operator docs, and the required metrics record; product runtime code is unchanged.

Evidence

• [codex] fix protected release-evidence approval #1138 independent review: accepted with no blockers
• exact implementation head: workspace tests and all-target/all-feature clippy passed
• retrieval, runtime, stdio, plugin, docs, workflow-policy, anti-overfit, and repo-scale full-sidecar gates passed
• signing and notarization remain main-release-only

After merge

Restore dev/codestory-next if GitHub deletes it, clear the old SHA-bound approval, and measure the new exact main commit once before any release re-evaluation.

Closes #1139
Refs #1137
Refs #1136
Refs #899