fix: finalize v1.0.1 public client release candidate

[Coding-Dev-Tools]

Summary

Finalizes the public Engraphis 1.0.1 client candidate from all local commits that were ahead of origin/main.

• restores explicit managed-compute consent and gives Analytics/Automation safe, actionable consent-required responses
• preserves selected Pro/Team plan parameters through hosted signup and Checkout
• keeps Cloud Sync recoverable after a persisted authorization denial, renewal, or reconnect
• preserves typed cloud-session failures so revoked access, unsafe local state, and outages remain distinguishable
• requires globally routable hosted destinations and pins credential-bearing TLS connections to vetted addresses while preserving original-host certificate checks
• removes sensitive exception details, workspace names, and record identifiers from fallback diagnostics
• reconciles 1.0.0/1.0.1 release notes, customer docs, template inputs, and demo/browser configuration

Verification

• commercial manifest and strict-diff checks
• Ruff across the repository
• full offline pytest suite
• sample and codemem retrieval evaluations: recall@5, hit@5, and answer-token recall all 1.000
• ablation gate, including PPR multi-hop graph recall 1.0
• Python 3.9 syntax parse of all 220 tracked Python files
• Playwright commercial recovery/consent suite: 7 passed
• live unauthenticated health probes for api, relay, and compute endpoints
• sdist and wheel build for 1.0.1
• Twine validation and clean-wheel vulnerability audit
• npm production audit: 0 vulnerabilities

Release boundary

This PR validates the public customer package and client-side Pro/Team surfaces. It does not tag, publish, deploy, enable production signup, or claim that live Stripe/email/Team/backup/alerting canaries have been completed.