(release): publish privacy-reviewed hardening

[kyeunga25]

Summary

• publish the reviewed invite-only Campaign Pack workflow and public-safe guides
• align with the latest main and incorporate the reviewed Access JWT failure classification
• preserve fail-closed registration, external generation, and payment boundaries

Verification

• npm run check
• npm test — 407 tests passed
• npm run build
• npm run cf:dry-run
• npm run release:check -- --history
• production and full dependency audits — no known vulnerabilities
• all D1 migrations applied successfully to a fresh local database
• desktop and 390 × 844 demo flow QA — no console warnings or horizontal overflow

Protected deployment mappings and credentials remain outside the repository.