Prepare v1.6.0 immutable release qualification

[jeffhuber]

Prepares #1105.

Code Mower's merged v1.6 work now has one coherent release identity, complete entry evidence, and an immutable-candidate contract. This PR advances the source/package identity to v1.6.0, binds rollback to the canonical v1.5.2 wheel digest, updates current installation and release documentation, and defines the serial canary, soak, audit, publication, and reinstall sequence.

This PR does not build the immutable candidate, run the retained-candidate private canary, tag, publish, merge itself, or claim post-merge evidence that does not exist. The immutable candidate can be built only from this PR's merge SHA.

The release scope includes merged Board inventory/version guidance from #1063/#1109, repository-isolated PR cost attribution from #1106/#1108, and bounded payload-aware audit history with exact control-marker parsing from #1104/#1107. The #1097 release wording is narrow: an ordinary PR with no Code Mower provenance is neutral unmanaged; a visible malformed Code Mower claim remains actionable and fail-closed.

Entry gates before final review and merge

• v1.6.0: align Board inventory filters, versions, and service guidance #1063 merged through v1.6: align Board inventory and service guidance #1109; this branch is rebased onto that accepted head.
• v1.6.0: make audit comment ingestion payload-aware #1104 merged through v1.6.0: harden audit comment ingestion #1107; this branch is rebased onto that accepted head and the final hardened behavior is reflected in the release contract.
• Hosted PR v0.9: harden install and upgrade docs #542 merged at bcddaa25c633f2dcf8fa2077d6ecb8004c1d8f88 after exact-head Claude audit, Code Mower gate, and full CI passed.
• GitHub deployment 6581697672 completed the two-step rollout and production deployment dpl_HxhK4CHrYPkCCzjxS9rGjSuBG8C8 is Ready.
• Authenticated health advertises capability schema code_mower.controlSurfaceSessionSummaryCapability.v1, summary schema code_mower.controlSurfaceSessionSummary.v1, capability version 1, fixture-manifest SHA-256 9e87c52812a49a1c72d0e0d2448661a3ef17cb8539ca8e029c6669ea9738d62e, and accepting: true; closed-first accepting: false was verified.
• Hosted acceptance reconciled the 79/79 migration ledger at digest dec1a7338629e50e9edc5a927295736e4d74563775dd9af29bd38f8d3a234cdd; sanitized probe upload 650c9bb7-2d51-4b1e-877a-7f2bdf54c174 was accepted exactly once and isolated to jeff-internal. Public receipt: v1.6.0: minimal CodeMower.com Slack telemetry ingestion and aggregates #978 comment 5770184083.
• Final release scope, required package inventory, release notes, qualification contract, roadmap, and runbook agree.
• release.yml is stage: stable on this review head.

Evidence required after merge

• First-attempt immutable candidate built from the release PR merge SHA.
• Exact candidate install, v1.5.2 upgrade, digest-verified rollback, Graphify, Board, Slack, privacy, and capability checks pass.
• One bounded private Slack telemetry canary reconciles local Board state with authenticated hosted totals. The pre-candidate hosted acceptance probe does not replace this gate.
• Retention, export/deletion, tenant isolation, capability disablement, and rollback pass.
• The unchanged candidate soaks for at least 24 hours and receives two independent installation or upgrade passes.
• Retained bytes are tagged, published, attached to the GitHub Release, and independently reinstalled from canonical PyPI.

Validation

• ruff check .
• 472 release, identity, documentation-lifecycle, hygiene, and documented-command tests passed with 1,973 subtests
• release renderer, documentation lifecycle, release identity, and release-readiness checks passed
• fresh v1.6.0 wheel and sdist built locally, passed twine check, and contained all 19 required release files plus five required release documents
• generated documentation index and package manifest match their sources
• frozen v1.6 document digests match the documentation manifest
• the readiness marker now binds §3 candidate qualification to capability-gated lifecycle-summary, with a regression that fails if the section loses that assertion

Fresh exact-head Claude audit, CI, and the authoritative Code Mower gate are required before merge.

[github-actions]

Claude audit (merge-authority lane)

Head SHA: de4a90f0ade9614957e1678307452eece0f566a2
Verdict: BLOCKED
Review details remain in the local audit artifact.
Publication workflow: .github/workflows/local-audit-publication.yml at 166013b017988938d0085a870993ca975b0413dd

[github-actions]

Codex audit (merge-authority lane)

Head SHA: de4a90f0ade9614957e1678307452eece0f566a2
Verdict: PASS
Review details remain in the local audit artifact.
Publication workflow: .github/workflows/local-audit-publication.yml at 166013b017988938d0085a870993ca975b0413dd

[github-actions]

Claude audit (merge-authority lane)

Head SHA: 98eea9a793cd3e2739175016693d2e447b852ac8
Verdict: PASS
Review details remain in the local audit artifact.
Publication workflow: .github/workflows/local-audit-publication.yml at 166013b017988938d0085a870993ca975b0413dd

[github-actions]

Codex audit (merge-authority lane)

Head SHA: 98eea9a793cd3e2739175016693d2e447b852ac8
Verdict: PASS
Review details remain in the local audit artifact.
Publication workflow: .github/workflows/local-audit-publication.yml at 166013b017988938d0085a870993ca975b0413dd