fix(release): complete consolidated cloud installer delivery

[avabbbb]

Current main cannot produce a downloadable Windows installer: the empty-state test expects old Resume copy, and worker soak rejects the now-default bounded Role Intelligence task. This reconciles those E2E contracts, salvages the remaining safe PR77 review fixes, and adds opt-in cloud prerelease publishing.

User-visible behavior: incomplete review material is a warning; pending prepare groups have a decision path; users can reject unprepared or ended-run groups. Stale-source approval, unknown effects, native UI authorization and plan/group digests remain protected. The mounted review surface shows the warnings. No Skill-grant expansion was ported.

Cloud delivery: publish_candidate=true publishes verified installers as an unsigned Owner Dogfood prerelease pinned to the build commit. Formal v* signing and Public Release readiness gates remain unchanged.

Validation:

• Integrated backend flow/policy/endpoint/harness tests: 66 passed.
• Frontend review tests/typecheck passed before final display cleanup; CI exposed 1 stale fixture (199 passed). That failure was reproduced at the exact integrated SHA and fixed; the explicit-worktree-config regression now passes 4/4. Latest full frontend CI is pending.
• Artifact/readiness/version tests: 24 passed, 4 Windows symlink/platform skips, 3 subtests.
• actionlint 1.7.12 and diff check passed.
• Full latest-SHA GitHub checks, browser E2E, cloud package and installed-app smoke are required before delivery; real model/owner product acceptance is not claimed.

Historical S0, Agent/Canvas and docs branches were audited: completed code is already absorbed by main. Their original SHAs are preserved in verified Git bundles. This PR supersedes the useful remaining scope of #77.