[codex] record v1 release gate audit and privacy consistency

[greenthree]

What changed

• Record the 2026-08-13 v1.0.0 release-gate audit and current production evidence.
• Document that the approved Auth 429 drill was cancelled before any login request or production mutation.
• Align repository and in-app privacy copy with the production email-confirmation requirement.
• Update the release checklist and operations runbook with verified retention/readiness facts and remaining blockers.
• Add regression coverage for the privacy date and email-confirmation wording.

Why

The previous privacy copy claimed that registration accounts were immediately enabled, which contradicted the deployed Supabase Auth confirmation-email requirement. The release audit also needs a durable, redacted record of the cancelled rate-limit drill so it cannot be mistaken for a successful 429 recovery observation.

Validation

• npx prettier --check ...
• npm run lint
• npx vitest run src/pages/PrivacyPage.test.tsx src/pages/RegisterPage.test.tsx (19 tests)
• npm test (98 files, 636 tests)
• npm run build

Remaining release blockers

• Auth 429/recovery evidence remains incomplete because the production drill was cancelled.
• Firecrawl fixed record-retention confirmation.
• School/team/ICPC name and graphic-mark authorization.
• Observation of the 2026-08-18 XCPC ELO/QOJ weekly batch.

This draft PR does not deploy production, modify Auth/Secrets/Vault/database/functions, or create a version tag.