feat(release): declare rollback compatibility boundary

[jiashuoz]

Summary

• add tracked ROLLBACK_UNSAFE_BEFORE, initially none, and publish it as org.e2a.rollback-unsafe-before on release images
• enforce syntax and the cumulative/append-only boundary across the complete file history (--full-history --topo-order --reverse), including merge-side commits and publisher entry points without an event base
• require every non-PR image-publishing commit to already be contained in OSS main
• document that none covers every rollback-eligible retained production binary; hosted S1 in tokencanopy/e2a-ops#276 executes those exact digests after candidate migrations

Why

The hosted compatibility guard treats missing rollback metadata as unknown and blocks rollback. This PR makes the assertion explicit in immutable image metadata; the hosted gate turns a none claim into prod-clone evidence against pre-migration data and fresh stable CRUD.

This is independent of the in-progress CLI/MCP conformance test fixes.

Validation

• exact pushed head: 05ddf7c28f96c521f1acf6683636794524529624
• scripts/check-repository-text-integrity.sh
• scripts/test-check-rollback-boundary.sh, including merge-side history, safe-to-boundary, unchanged boundary, reset/move rejection, omitted-base history enforcement, and unresolvable required bases
• workflow YAML parse and git diff --check
• all hosted build, test, coverage, SDK/CLI/MCP/OpenAPI, integrity, and CodeQL checks are green
• independent final review of this exact head found no code blockers

No API, SDK, CLI, MCP tool, database-schema, or runtime behavior changes.