fix: stabilize Matter convergence and Gate 1 packaging

[shawliu998]

What changed

• add a single workspace inference-policy authority for Matter, Assistant, Workflow, and Tabular execution boundaries
• add the v17 privacy/model-policy migration and secret-free inference decision ledger
• complete the continuous Matter workspace shell, settings, capability routing, pagination, and compatibility behavior
• repair Local-first CI provenance/readiness checks and strict frontend/package build contracts
• restore the complete Playwright E2E gate and add bounded fail-closed handling for transient SQLite lock contention
• add packaged restart-persistence coverage, Gate 1 audit documentation, and redacted evidence

Why

The merged Matter convergence work left several release-blocking gaps: policy enforcement could be bypassed at provider boundaries, Matter settings were not fully durable across packaged restarts, CI/package checks relied on stale or unreachable build/provenance assumptions, and the UI gate no longer exercised the complete E2E suite.

Impact

Matter workspaces now use one explicit inference policy across global, project, and matter scope. Provider calls are checked at both preparation and final execution boundaries. Profile, policy, default-model, chat, sources, and capabilities survive an offline packaged restart. The complete legacy UI suite remains enforced.

Root causes

• duplicated policy/runtime authorities and missing final provider-boundary enforcement
• stale readiness/provenance assumptions after convergence and in shallow Actions checkouts
• package validation targeting the wrong Next.js output directory
• Playwright collection mixing Node tests with browser specs, followed by stale route and fixture assertions
• transient SQLite lock contention during seeded E2E setup

Validation

• Backend P0, convergence, build, migration, inference-policy, workflow, Assistant, Tabular, and package preflight audits passed
• Local-first Actions command block passed 14/14
• Frontend lint, P0 client tests, production build, CSP/i18n/diff checks passed
• Complete Playwright suite: 172 discovered, 159 passed, 13 expected project-conditioned skips, 0 failed
• Full macOS package pipeline passed: startup, migration, Gate 1 E2E, offline restart persistence, backup/restore, restore fail-closed, native OCR, package hygiene, and checksums
• Independent final diff audit found no P0/P1 regressions

Release note

The locally generated macOS artifacts are intentionally unsigned and unnotarized. They are acceptance-test artifacts, not distributable release binaries.