docs: audit ScriptCut release system

[FernandoAbishai]

What changed

Adds docs/RELEASE_SYSTEM_AUDIT.md, a source-verified Phase 4A release-system audit and contract repository covering:

• current developer, QA, candidate, dry-run, and public release paths;
• release identity sources and a proposed product/channel/iteration/tag/build contract;
• release-like npm command inventory and ambiguity classification;
• gate lifecycle matrix, runner ownership, duplication, and open gaps;
• documentation drift, release-notes/changelog behavior, post-publication completion, and bundle-size measurement boundary;
• current security/trust invariants and the recommended 4B/4C/4D/4E implementation plan.

Scope

Documentation/audit only. No product code, runtime, packaging, workflow, package version, tag, or release changes.

Validation

• git diff --check
• npm run smoke:public-release
• npm run smoke:release-workflow
• npm run smoke:runtime-artifacts
• npm run smoke:runtime-contract
• Verified 31 referenced repository paths and all npm commands referenced by the audit.

Please do not merge this draft PR until the Phase 4A findings and proposed contract are reviewed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.