[Phase L] Cross-cutting adversarial pass + docs + release packaging

[cuttlefisch]

Part of #542. Depends on #543 + #544 + #545 + #546 + #547 + #548 + #549 + #550 + #551 + #552 (+ #553 if pulled into this milestone).

What

Final pass re-running all G1-G5 gates together (not just per-phase), updating docs/KB_SHARING.md/SECURITY_REVIEW.md for the new webview surface, and deciding release-milestone grouping.

Why

Per CLAUDE.md principle #14, no phase closes on "code merged" alone — the whole initiative needs one final pass verifying the gates hold in combination, not just individually per-phase (e.g. a wedge-rendering change from Phase G plus a daemon change from Phase J could interact in ways no single phase's own tests would catch).

Definition of done

• All five gates (G1-G5) re-verified together against the full merged state, not per-phase in isolation
• docs/KB_SHARING.md and docs/SECURITY_REVIEW.md updated to cover the new webview surface (OAuth-only v1 scope, mTLS-parity deferral, SSE push scope-filtering guarantee)
• self_test_suite + make test-scheme-all green
• Release-milestone grouping decision recorded (per [KB-Graph-UX epic] mae-canvas substrate hardening + chord-diagram wedge redesign + live daemon-hosted HTML KB view — tracking #542's release sequencing note: Phases A-D/F/G-I as an earlier local-only milestone; E/J/K following)
• Final adversarial review pass per CLAUDE.md principle feat: editor polish, version bump & new features (v0.3.0) #14: "what did these tests not try to break?" — any gap found becomes a follow-up issue, not silently accepted