[B2] Consolidate release locks, prerelease logic and version truth

[SisyphusZheng]

Required work

Re-verify and fix: M14 release local mutual exclusion (CI concurrency group exists at .github/workflows/autoflow-release.yml:18-20; NO local lock in tools/autoflow/ — confirmed at 2936bf0); M16 duplicated prerelease/version magic (≥6 production copies: tools/project-constants.ts:93-99, tools/bump-version.ts, check-strategic-docs.ts:78, check-version-anchors.ts:285, check-docs-truth.ts:288-289, autoflow/cli.ts:44; hard-coded 0.41.0-alpha.14 twice); M17 docs whitelist substring matching (check-docs-truth.ts:192-216,228,537-540).

Acceptance

One canonical prerelease/version truth implementation; local/CI release mutual exclusion; whitelist matching by exact path semantics.

Part of umbrella #1155. Depends on: #1216 (canonical verdict contract).

[SisyphusZheng]

Operational evidence from A10.6 (PR #1249, 2026-09-02): tools/check-frozen-semantics.ts derives its change set from 'git diff --name-only ' on COMMITTED ranges only (CI: merge-base with GITHUB_BASE_REF; local: origin/main...HEAD). A local run with uncommitted working-tree changes therefore passes vacuously even when frozen paths (authoring.ts) are modified — the failure only surfaces in CI. Add to the M15/B2.9 scope: local invocation should include the working-tree diff, or the gate contract should be documented as CI-only. Fixed in the instance by citing amendment ADR-0151 in the PR body.

[SisyphusZheng]

Closed by PR #1290 (squash-merged to dev as ac909e0d; auto-close did not fire because the merge target was dev, not the default branch).

Evidence:

• M14: tools/autoflow/release-lock.ts — atomic createNew local lock at .artifacts/autoflow-release.lock, acquired by all five release-mutating CLI commands; concurrent local release exits 1 naming the holder; verified end-to-end (exception path releases, held lock refuses, stale lock fail-closed).
• M16: canonical tools/lib/version.ts (parse/prerelease/compare/nextPatch/normalize/FIRST_TAGGED_VERSION); all ten former copies rewired as delegates; duplicate hard-coded 0.41.0-alpha.14 eliminated.
• M17: isCurrentDocAllowed() exact-path semantics in check-docs-truth.ts; 13 dead whitelist entries dropped; lookalike-substring tests added.
• freeze:semantics gap: proven one-directional fail-closed (local diff ⊇ CI diff under ADR-0151 topology; origin/main ancestor of every dev-based PR head verified), documented in check-frozen-semantics.ts header. No local green can mask a red CI; residual is local false-FAIL only.
• PR CI green at merge (autoflow-ci incl. docs:check-current, full test suite, pack:dry-run + package-artifacts:check).