Harden release readiness and economic guidance

[GGULBAE]

What changed

• ship an iOS SDK privacy manifest in a namespaced CocoaPods resource bundle and verify it in package, registry, consumer, and built-app contracts
• keep v0.4.1 release notes true before and after publication, with fail-closed checks for stale candidate language at release state
• add a local-only byte-economics calculator that separates source/output observations, matched-baseline transfer, app-owned staging, and count-priced costs
• add a contract-based image-pipeline selection guide without universal speed or quality claims
• improve native guided-demo progress accessibility and the cleanup test mock
• require all three CodeQL analysis jobs on master, with live ruleset and repository-contract drift checks aligned

Why

The source candidate used lstat for package-cache ownership checks but did not ship its own required-reason privacy manifest. The release workflow also reused candidate-timed notes as an immutable GitHub Release body. Both gaps could make a correct source candidate fail integration or publish stale claims. The new economic tools make the public value case useful without turning illustrative byte arithmetic into unsupported savings claims.

Validation

• pnpm verify — 51 files / 479 tests, 94.32% statements, 84.30% branches
• pnpm example:typecheck
• pnpm site:build
• pnpm site:quality — performance 99, accessibility 98, SEO 100; 18 axe routes clean
• pnpm pack --dry-run — includes ios/PrivacyInfo.xcprivacy
• plutil -lint ios/PrivacyInfo.xcprivacy
• ruby -c react-native-image-compression-kit.podspec
• pnpm audit:repository-settings — live protected-master ruleset aligned

This PR does not publish, tag, or release npm v0.4.1.