ops: candidate promotion evidence and pre-stop drain safety

[Anton-Babaskin]

Delivered

• v0.5.0-rc.1 released after native Linux/Windows acceptance; PR 56 merged green.
• Same reviewed 303e105 runtime built and promoted to dedicated staging; both containers healthy and non-root/read-only; rollback image and metadata pair retained.
• External trusted HTTPS/security gate passed; real Mail-in-a-Box synthetic attachment copied once and repeat copied zero, exact body/flags/date, source unchanged, terminal envelopes zero.
• README download links and cross-computer handoff updated with actual evidence and remaining gates.

Operator fixes

Shared read-only guard refuses active API/worker work and credentials before stopping staging; authority helper now reads snapshot.view.status and allows retained terminal history. Tests assert no stop/pin/backup side effects on refusal. Exclusive maintenance remains required; this is not an atomic ingress lock. No routing/VPN/front-end source edits or disk resize.

Verification

58 Linux Python tests with one local age-tool skip; CI installs age. Documentation links/diff checks pass. Release candidate runtime is unchanged; this PR updates operator tooling and records completed promotion.