Define DoneState lifecycle receipt gates

[AyobamiH]

Outcome

Reconciles RC5 publication state and records merge, deployment, and release as separate future AgentProof lifecycle candidates.

This deliberately does not add speculative runtime actions: agentproof.repository_patch.v1 remains the only proven action until production authority/signing, deterministic reconciliation, independent verification fixtures, and a live canary exist.

Validation

• full npm run check: passed
• 49/49 tests
• documentation closure and package audit passed
• remote branch tree matches local tree: d22a1031c76c3e5a82c0fe3b6f01e80c0a106483

[AyobamiH]

Review completed against the exact head. No blocking findings. The change records lifecycle candidates without adding unsupported action constants, CLI/SDK surfaces, or runtime authority; repository_patch.v1 remains the only proven action. CI, documentation closure, and package audit passed. This is a COMMENT review, not self-approval.