feat(ci): tag-blocking release QA gate — server-type matrix + invariants (Spec 081 T1)

Wire the Spec 081 stage-1/2 gate driver + fixtures into CI as a single
reusable workflow that qualifies a release tag before any artifact is
published.

## Workflow (.github/workflows/release-qa-gate.yml)
- workflow_call (publishers) + workflow_dispatch (dry run, publishes
  nothing — FR-001a); TEMP push trigger on the T1 branch for real CI.
- build-candidate: frontend build + embed + go build of the candidate
  core, fixtures and release-gate driver, shared as one artifact.
- suite-api-e2e: scripts/test-api-e2e.sh UNMODIFIED (FR-003).
- suite-race: go test -race ./internal/... + server edition.
- suite-scan-eval: scan-eval --gate --min-recall 0.90 --max-fp 0.05 on
  every tag regardless of changed paths (FR-015). The bare FR-003
  command omits the required --corpus flag; the full eval.yml invocation
  is used so the gate actually runs.
- matrix-invariants: five fixture upstreams (stdio/http/sse/docker/oauth,
  connect→list→call→kill/reconnect) + activity-request-id / counters /
  quarantine-flow / upgrade-in-place invariants; matrix + invariants run
  in one shell so the state-file'd core survives between them.
- verdict (if: always()): merges fragments against the hardcoded
  gatereport manifest, uploads gate-report.json, exits per verdict. A
  missing blocking fragment is a FAIL (fail-closed, FR-004). Every job
  has an explicit timeout (FR-005).

## Publishers wired (FR-002)
- release.yml: qa-gate job (reusable workflow) added; release.needs gains
  qa-gate so every public job cascading from release is gated. Guarded to
  the same stable-only condition so a skipped gate skips release too
  (never un-gates) and RC tags don't double-run the gate here.
- prerelease.yml: same, guarded to prerelease TAG refs only (skips on the
  next branch).

## Audit (FR-022 / SC-004)
- cmd/release-gate/workflow_audit_test.go parses both publisher workflows
  with yaml.v3 and asserts every artifact-publishing job's transitive
  needs closure includes the qa-gate job; statically disabled (if: false)
  jobs are excluded.

## Docs
- docs/development/release-gate.md: what runs, how to dry-run, the
  T2/T3/T4 reserved extension slots + macOS-smoke promotion criterion,
  the FR-003 -short fallback note, and the FR-011 request-id correlation
  finding (X-Request-Id is not persisted on tool_call records today;
  correlation falls back to argument nonces + core-recorded ids).

Author: Dumbris

.github/workflows/prerelease.yml

@@ -757,8 +757,19 @@ jobs:
           name: installers-${{ matrix.goos }}-${{ matrix.goarch }}
           path: installers-artifact/*
 
+  # Spec 081: release qualification gate (same reusable workflow as release.yml).
+  # Guarded to prerelease TAG refs only — skipped on `next` branch pushes,
+  # consistent with the `release` job's own tag condition, so branch CI is not
+  # burdened with the full gate. A red gate blocks the prerelease publish
+  # (FR-002); a skipped gate (branch push) skips `release` too (never un-gated).
+  qa-gate:
+    uses: ./.github/workflows/release-qa-gate.yml
+    permissions:
+      contents: read
+    if: startsWith(github.ref, 'refs/tags/v') && (contains(github.ref, '-rc.') || contains(github.ref, '-next.'))
+
   release:
-    needs: build
+    needs: [build, qa-gate]
     runs-on: ubuntu-latest
     environment: staging
     # Only create releases for tag pushes, not branch pushes