Repair release-gate checks and AI approval timing

[atx-omni]

Summary

• Fix lint errors blocking the scheduled release gate while preserving intentional input sanitization and validation.
• Project public enablement-module fields explicitly and verify internal selection metadata is not exported.
• Patch postcss-selector-parser from 6.1.2 to 6.1.4 in the lockfile.
• Align migration regression fixtures with verified shared/workbook source evidence; unknown source fields still block writes.
• Isolate mocked transport tests from external DNS while retaining production URL and SSRF checks.
• Update browser fixtures for current destination, readiness-cancellation, saved-instance, and SCIM behavior.
• Fix a real AI Content Studio race: a late topic inventory must not clear an approved model-wide scope when no topic was selected. A disappearing selected topic still revokes approval.
• Await the actual asynchronous result-read counters in result-recovery tests, without extra job creation or cancellation.

Validation

All affected local checks passed: 113 AI Content Studio unit checks, 112 migration-planner checks, 86 affected mocked-transport checks, and all 139 canonical browser cases across bounded runs. The five latest affected browser cases passed in CI mode with retries disabled. The delayed-topic regression deliberately holds the topic response and checks the unchanged approval before and after it arrives.

Both type checks passed. Lint passed with zero errors and seven existing warnings. Diff checks passed. The previous full GitHub run passed the static, build, security, and unit suites through Semantic Studio, then exposed the AI UI race and premature result-counter assertion repaired above.

Final GitHub validation PASSED on c119616. The complete run passed all unit/contract suites and all 139 browser cases, with zero failed or skipped tests and no flaky browser results. Static checks, build, bundle budgets, audit, license verification, and SBOM checks passed. Fresh independent approval is still required; this PR has not been merged.

• Required security gate: https://github.com/exploreomni/OmniKit/actions/runs/35649998245
• Full canonical release gate: https://github.com/exploreomni/OmniKit/actions/runs/35649991481

Boundaries

ExploreOmni only. No workflow, branch-protection, credential, live-tenant, or ATX changes. No skipped or disabled checks were added. Normal required checks and fresh independent approval remain required before merge. CI establishes development confidence, not live tenant acceptance or completion of external legal/ownership release requirements.

Default-branch dependency alerts are not claimed closed before merge and a fresh scan. The AnyIO alerts reference the retired migration-engine manifest, absent from the current tracked main tree.