feat(workflow): add preflight, cleanup, artifact-scan, version/tag checks

Adds six sanity-check layers to the release workflow:
- preflight: orphaned worktrees, baseline green, plan-state grep, branch collision
- cleanup: removes merged worktrees + branches (git branch -d, never -D)
- debug artifact scan: dbg!/ console.log / TODO / unwrap() in diff (advisory)
- checkbox hygiene: unticked plan tasks before verify (advisory)
- pre-release version consistency across Cargo.toml workspace
- pre-release tag collision check

CLAUDE.md: discipline rules 5 (preflight before develop) and 6 (cleanup after lift).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -154,3 +154,7 @@ Four rules to prevent the kind of drift the 2026-05-30 audits found:
 4. **Plan-state hygiene.** Plan checkboxes and `STATUS.md`/`ROADMAP.md` must reflect what's actually shipped. Two halves:
    - **Ship side:** when a commit lands work that maps to a plan task, tick that plan's checkboxes in the same commit (or the immediately-following docs commit). Same for `STATUS.md` — the "Up next" list does not get to lag the actual state of `main` by weeks.
    - **Execute side:** before starting execution of a plan whose checkboxes are all unchecked, spot-check git log (`git log --oneline --all --grep <distinctive-name>`) or grep for a distinctive symbol/file the plan would create. A plan whose work already merged is the worst kind of plan to re-execute. The 2026-05-30 status-audit found Phase 2B, v0.5.1 Streams A/B/C, and 1C-γ all stealth-shipped two-to-three weeks earlier because nobody ran this check.
+
+5. **Pre-flight before develop.** Before running `action:"develop"` on any release, run `action:"preflight"` first. If preflight reports FAIL (baseline not green or version mismatch), fix the failure before proceeding. WARN results (orphaned worktrees, partially-done plan) require a judgement call — acknowledge them explicitly before proceeding.
+
+6. **Cleanup after every lift.** Once all PRs for a release are merged into main, run `Workflow({name:"release", args:{action:"cleanup"}})` to remove the lift's worktrees and feature branches. Stale worktrees accumulate silently and create confusion for the next lift's branch-collision check.