release: v0.22.3

[bug-ops]

Summary

• Bump version from 0.22.2 to 0.22.3 across the workspace (Cargo.toml, Cargo.lock)
• Finalize the [Unreleased] CHANGELOG.md section into [0.22.3] - 2026-07-22
• Sync /specs (18 files updated, new 083-memory-write-consent-gate spec) with behavior shipped since v0.22.2
• Sync book/ user docs (4 chapters: observability, sub-agents, gateway, configuration reference)
• Sync crate READMEs (root + zeph-channels, zeph-subagent, zeph-memory, zeph-commands) and refresh the root tests badge (14890 -> 15347)
• Update TUI splash-screen snapshot tests for the new version string

Checklist

• Version updated in all manifests (workspace version.workspace = true inheritance verified)
• CHANGELOG.md has release section with date
• README reflects new version and test count
• All CI checks pass locally (fmt, clippy --profile ci, nextest CI feature set: 15062/15062, nextest full: 15347/15347, rustdoc gate, doc-tests, gitleaks)
• Ready for tagging after merge

[bug-ops]

Fixed the non-Linux CI failures from run 29873938646:

• Stack overflow in the serve::agent_factory tests on macOS/Windows shard jobs — same root cause already fixed for the coverage job, now also applied to ci-non-linux.yml's sharded test job (RUST_MIN_STACK=32MiB).
• Two risk-chain tests (agent_setup.rs, acp.rs) relied on a real /etc/passwd read succeeding — swapped to echo /etc/passwd, which the classifier still pattern-matches on but which succeeds on Windows.
• A durable-path test asserted a hardcoded forward-slash path against Path::join's platform-native output — now builds the expected value the same way.
• A file-lock contention test now gated #[cfg(unix)], matching zeph-session's own tests for the same flock(2)-backed primitive (a documented no-op on non-Unix).

All four fixes verified locally (targeted nextest run, full fmt/clippy/nextest suite). Triggering CI (non-Linux) on this branch to confirm.