Harden GitLab review delivery for toolkit 0.4.7

[xeonvs]

Summary

• prove GitLab suggestions against one exact contiguous range in the immutable reviewed head before rendering an apply button;
• add conservative default-on exact-SHA GitLab automatic approval with an explicit opt-out and add-only provider semantics;
• qualify Open Code Review 1.9.0 and 1.9.1 separately, promote checksum-verified 1.9.1, and update the local/public compatibility contract;
• harden the final-release lifecycle with trusted-base authorization, exact tree/parent/check-App binding, bounded atomic GitHub reads, deterministic receipts, provenance and supported-Python verification, and post-release issue closure without a repository closure PR.

Safety and architecture

• the mandatory built-in ocr_toolkit_evidence MCP remains independent and cannot be replaced or shadowed by optional external MCP entries;
• automatic approval is bound to the exact reviewed SHA and runs only after all current review notes publish;
• existing approvals are never removed automatically because GitLab cannot bind unapproval to an immutable reviewed SHA at mutation time;
• the release candidate is inspected only as bounded data; authorization code executes from protected policy that predates the release PR;
• repository content, OCR output, persisted receipts, provider responses, and HTTP artifacts remain bounded and fail closed.

Validation

• one final local OCR 1.9.1 review of the committed feature tip completed all 23 selected items, made 68 mandatory built-in MCP calls, and produced private result/stderr artifacts; no GitLab posting occurred;
• all actionable findings from that single OCR run were corrected, followed by deterministic tests and manual self-review; no second OCR or Codex Security run was performed;
• Python 3.12.13: 623 tests + 85 subtests, 79.09% coverage, Ruff format/lint, strict mypy, and Bandit with zero medium/high findings;
• fresh wheel/sdist: Twine, zero runtime dependencies, Python 3.12-3.14 metadata, restricted-PATH hostile-shadow install smoke, and pip check;
• OCR manifest, Towncrier 0.4.7 draft, workflow YAML, changed ShellCheck, public-content privacy scan, git diff --check, signed commits, and pinned local Gitleaks 8.24.3 across the complete feature history.

Delivery

Refs #70
Refs #71
Refs #72
Refs #73

These issues intentionally remain open until stable toolkit 0.4.7 publication, immutable release receipt, independent registry/provenance/tag/Release/hash/install readback, and bot-owned issue receipt closure are complete.