[codex] Sync MFD release integrity state

[KevinBigham]

What changed

This PR syncs the current local MFD-main source/docs state into GitHub and includes the Wave 1 publication-integrity mission work:

• hardens GitHub Pages deploy to main only, pins pnpm to 9.15.9, and adds bundle-size plus built-page smoke checks after the web build
• updates README, CHANGELOG, navigation comments, release ledgers, and GOAT one-shot status docs
• adds release-doc drift coverage and registers it in the existing release-gate script-tests step
• brings GitHub up to the broader local release-gate/source state that the extracted working folder already contained

Why

The local working folder had no .git metadata and GitHub main was behind the local MFD source/docs state. Publishing only the ten Wave 1 files would have left release-gate docs/tests pointing at missing earlier release-gate infrastructure, so this branch syncs the coherent local state instead.

Impact

This is a broad repository sync plus publication-integrity hardening. It does not intentionally deploy, and it avoids pushing directly to main so the Pages deploy workflow is not triggered until the PR is merged.

Validation

In /Users/kevin/Downloads/MFD/MFD-main:

• corepack pnpm -r --workspace-concurrency=1 typecheck
• node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON --test scripts/__tests__/release-docs.test.mjs
• node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON --test scripts/__tests__/release-gate.test.mjs
• node scripts/release-gate.mjs --dry-run (36/36)
• corepack pnpm --filter @mfd/engine test -- src/config/navigation.test.ts

In the publish clone:

• node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON --test scripts/__tests__/release-docs.test.mjs
• node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON --test scripts/__tests__/release-gate.test.mjs
• node scripts/release-gate.mjs --dry-run (36/36)

No full release gate, build, browser smoke, visual sweep, playtest-all, shadow regression, push to main, or deploy was run.