feat: close R1 release gates and add local diagnostics

[caozx1110]

Summary

• close the R1 trust-chain, recovery, workflow-classifier, conversational UX, installer/update provenance, and release-engineering gates
• add optional D1 local diagnostics with off | errors-only | developer workspace policy, per-skill overrides, deterministic deduplication, redacted issue records, and explicit export authorization
• add layered read-only KB audit across schema, integrity, recovery, security, and quality without adding a sixteenth public kb verb
• keep end-user interaction natural-language-first; scripts continue to move and validate data rather than infer research conclusions

Validation

• post-merge full suite: 838 passed with 5 pre-existing SWIG deprecation warnings
• D1 focused suite: 29 passed
• all 17 bundled skills validated
• compileall, bash -n install.sh, pip check, and git diff --check passed
• detached-HEAD installer provenance reproduced locally and covered by an explicit regression
• hosted push and pull-request Linux/macOS matrices: 10/10 checks passed
• fresh installed-copy cold acceptance: P0/P1/P2/P3 findings all 0
• RT-2 and OpenVLA KB audit simulations each found 8 known recovery/quality issues while preserving byte+mtime tree digests
• 50 concurrent distinct diagnostics retained all records; 50 equivalent records merged to one issue with occurrences=50

Release status

This remains 0.2.0-rc.1: release-candidate-ready after hosted Linux/macOS CI, but not stable/GA. D1 diagnostics remain beta/scaffold. No real user kb/ data is included or modified, and no tag or publication is part of this PR.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.