feat: make feature and bug-fix delivery verifiable (v0.9.0)

[cskwork]

Problem and result

Ordinary feature requests did not enter the kit, small bug fixes followed a route incompatible with the shared stages, and approvals could remain usable after the reviewed artifact or code changed. This change makes feature and bug-fix requests use one compact/full workflow, binds gates to the reviewed inputs, and requires evidence of the agreed delivery before closing work as shipped.

Automation no longer skips semantic risk review on a clean keyword scan. Already authorized scope is reused, while required independent verification remains. Requirements and final evidence are durable; repeated all-stage dispatch, duplicate approvals, unconditional full-suite checks, and immediate evidence deletion are removed.

Compatibility

• Track: micro remains accepted as the compact route.
• Old unbound approval records need reapproval. Status messages explain how to continue older compressed work.
• init.sh removes only the exact obsolete kit-owned ignore entries; it does not modify the Git index.
• Hashes detect content changes. They are not authentication or proof that remote delivery occurred.

Validation

• bash gates/selftest.sh: 35 cases passed.
• bash gates/e2e.sh: 133 assertions passed, including real feature and reproduced bug flows, resume/approval invalidation, delivery mismatch, evidence persistence, and unsupported-path rejection.
• All shell syntax checks and git diff --check passed.
• Fresh-context independent review: no remaining blockers.
• Required Ubuntu, macOS, and Windows CI will verify this PR before merge.

Release

Prepares v0.9.0. Publish only after independent QA, required cross-platform CI, and the protected-main merge pass.