Prepare coordinated v0.1.0-alpha.1 release candidate

[MGRAFF2006]

Release scope

Creates the coordinated v0.1.0-alpha.1 local-first developer preview across all twelve Sorrel modules. The Hub remains explicitly localhost/dev-only; production auth, stable embedding ABIs, secret injection, and apps are out of scope.

Coordinated module branches

Each submodule pointer targets its pushed cursor/release-alpha-fefe branch. Merge those module branches before this root PR, then this PR records their exact release commits in release/manifest.json.

Highlights:

• Aligns sorrel-cli and sorrel-sdk-rust to the final Core alpha commit and adds a root consistency gate.
• Sets every publishable package/crate to 0.1.0-alpha.1.
• Adds dual MIT/Apache-2.0 licenses and changelogs across all repositories.
• Adds reproducible Node lockfiles and resolves audited dependency advisories.
• Hardens Hub defaults: localhost binding and bootstrap grants disabled unless explicitly enabled.
• Sends acting-principal headers from Hub-web mutations.
• Adds protocol/Core/workflow compatibility documentation and truthful alpha limitations.
• Synchronizes root, CLI, Hub UI, and public website documentation.
• Expands root E2E to use the FS-backed Hub and exercise colocated Git sync pull/push.
• Adds release manifest/pin/license/version validation, conformance validation, release/security/contribution docs, and configurable Docker preview ports.
• Records the first optimization baseline; warm 10k-file status is the first measured target (231.814 ms vs roadmap target 100 ms).

Verification

• npm run validate:release — pass
• npm run validate:conformance — pass
• npm run test:modules — all suites pass
• npm test — FS-backed full-stack no-mock E2E passes, including Git sync
• Rust clippy --all-targets -- -D warnings + fmt --check across Core/CLI/runners/Rust SDK — pass
• Docker Compose build + Hub/Hub-web/landing smoke checks — pass on configurable ports
• Core benchmark: snapshot 2k 26.009 ms; diff 2k 9.911 ms; log walk 500 3.463 ms

External CI blocker

The prepared root workflow update is not included because GitHub rejects workflow-file pushes from the available OAuth token without workflow scope. A repository administrator must configure SUBMODULES_TOKEN and apply the prepared checkout/Cargo-auth plus release/conformance/lint gates using a workflow-authorized credential.