Release 1.53: risk-aware execution profiles

[avksp]

Summary

• derive provider-neutral S0/S1/S2 execution profiles from frozen plans
• enforce route-bound token, invocation, wall-time, and host-attested usage gates
• add explicit managed-start to task-start profile handoff and bilingual operator documentation
• update package and plugin publication surfaces to 1.53.0

Validation

• 813 unit tests pass
• 80 focused risk-execution tests pass
• plan revision 12 lock/completeness pass
• ownership audit: 55/55 paths owned
• docs, no-model-call, policy-boundary, publication, and packaging gates pass
• independent OpenCode implementation audit accepted; no Claude/Anthropic used