[zoster81]

Scope

• Replace eight public preview apply commands with one confirm_verified_operation while preserving owning stores and error semantics.
• Maintain closed previewId/note contract, ownership bounds, operationKind, and regression coverage.
• Integrate Dependabot updates to CodeQL 4.39.1 and create-github-app-token 3.3.0 with version-independent security policy assertions.
• Update migration, tools, architecture and operator documentation.

Qualification

• Local Go normal/race suites, vet, staticcheck, govulncheck, golangci-lint passed on Windows with qualified toolchain.
• Updated Node policy tests passed (54/54), link checks passed.
• Await Linux/macOS/Windows GitHub CI full qualification before merging.

Do not merge or release until all required checks pass.