feat(roadmap): Implement focus-track foundations

[rahulbsw]

Summary

• establish the sequenced v1.1-v1.4 focus-track roadmap and release evidence
• add synchronized release packaging, Docker/Podman quickstart, and an isolated Podman-backed Minikube smoke harness
• add stable metrics/logging/readiness assets, Helm monitoring resources, and secure defaults
• add shared CRD conversion and structured validation plus the guided Kubernetes UI and pipeline detail APIs
• add fail-closed performance governance and keep AI research-only
• consolidate superseded docs, examples, scripts, and inert tests while preserving supported v1.x behavior
• add shared Codex/Claude project rules and remove generated/runtime artifacts from supported paths
• update Wasmtime and UI dependency locks to patched compatible releases

Compatibility and security

• preserves CONFIG_FILE, CRD v1alpha1, existing metrics, and existing UI APIs
• retains the current DSL, keyed partitioning, cache/compression contracts, and fresh validation before deployment
• production UI credentials must come from explicit secrets; development credentials require explicit development mode
• local cargo audit and both production/full npm audit report zero known vulnerabilities on this branch; inherited RustSec informational warnings remain documented by the audit tooling
• GitHub still reports a separate Dependabot backlog on the default branch; this PR does not claim to resolve repository-wide default-branch alerts

Verification

• cargo fmt --check
• cargo machete
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all --all-features (442 library tests passed, 5 ignored; all CLI, integration, and UDF suites passed)
• cargo package --locked --no-verify --allow-dirty
• operator fmt, machete, Clippy, and tests (10/10)
• UI tests (4/4), lint, type-check, unused dependency scan, production build, and production/full npm audits
• Helm lint; default, production-UI, development-UI, and monitoring renders; insecure UI render rejected
• Docker/Podman quickstart static lifecycle and Minikube-Podman static smoke suites
• retained configuration and production examples validated
• performance release-gate unit tests (3/3)
• workflow YAML parsing, documentation build/internal-link check, high-confidence secret scan, and git diff --check
• same-session Criterion A/B for Wasmtime 36.0.10 versus 36.0.13: no detected change in all three native no-UDF controls; multiple UDF invocation paths favored 36.0.13

Known limitations

• a fresh live Podman-Minikube rerun was blocked because the existing local Podman VM is stale and its SSH connection resets; the harness stopped before creating resources. The prior successful isolated source-built run remains documented, and published-artifact/clean-host/dedicated-performance release gates remain pending in the roadmap.
• the dependency-free local Jekyll link build passed; the exact remote-theme build remains CI-owned because jekyll-remote-theme is not installed locally.

Rollback

Revert this commit to restore the previous source, deployment assets, documentation, and dependency locks. No deployment or release was performed by this change.