Release baseline commands, open-question gate, ESM v16 and event identity publication check

[woksin]

Added

• cratis screenplay baseline check [ROOT] and cratis screenplay baseline admit [ROOT] --release <LABEL> [--from-esm <FILE>] check a model against its committed release baseline and admit a release into it, using Screenplay's own baseline rules. They exit 0 when clean or admitted, 1 on violations and 2 when they could not run, so a CI job can gate on check and a release job can run admit --release $TAG. See the Screenplay command reference. (Expose screenplay baseline admit and check #351)
• cratis screenplay validate --open-questions report|fail reads the model's open questions from its notes. report prints them and keeps the validation result; fail exits 5 while an open question remains, and unreadable notes exit 1. (Public root-aware reader for model-note open questions Screenplay#694)
• cratis render admits ESM v16: an event's id pin keeps its stored event type name when you rename the event. (Admit ESM v16 (stored event names) in cratis render #353)

Changed

• Every cratis render, at application scope and for selected scopes, including --check, now runs Stage's publication check against the destination before writing. A render that would change an existing Chronicle event type id, or cannot read one safely, is refused with CLI-RENDER-016 and Stage's STAGE-EVENT-002 diagnostic; nothing is written and --force does not bypass it. Pin the event's id to keep its stored name. (Refuse publication on every non-Compatible Stage publication check, at every render scope #354)
• An existing destination file that cannot be read for that check is refused instead of failing with an unhandled error. (Refuse publication on every non-Compatible Stage publication check, at every render scope #354)
• The CLI bundles Screenplay 4.154.0 and Stage 4.96.0, which brings Chronicle 19.55.2 and Arc 22.87.0 to rendered applications.

[woksin]

Reviewer notes

• Full cross-provider review (Opus 5.5 + GPT-6.1 Sol, Astra verifying Opus) on the whole diff: passed, 0 blocking. Cheap advisories fixed in 6e43a33 (unreadable destination file → refusal; message spacing) and b6174e1 (malformed .cratis/ai.json → baseline exit 2; baseline specs use a link-free temp root instead of .ai-work).
• CLI-RENDER-015 was the retired navigation-property refusal, so the event identity refusal uses the new CLI-RENDER-016.
• Local Tier 1/2: Release build clean; Cli.Specs 3870/3871 (the one failure, for_LinuxDirectSecrets.when_a_store_operation_is_canceled, is untouched by this PR, timed out at load ~80 and passes alone); Chronicle integration 175/175; Templating 213/213; docs, pack and packaged placement green.
• Rendered React lane: failed locally three times at the first observable query with HTTP 500 ReadModelNotFound — Stage's harness starts scenarios once /healthz is 200, before the host's read models are registered (generated-react-browser harness runs scenarios before the host's read models are registered Stage#387). Rerunning the harness against the same rendered app passed 78/78, and Stage's own generated-react job passed with Stage 4.96.0 / Chronicle 19.55.2. CI's react job is the authoritative check here.
• Screenplay#694's CLI consumer (validate --open-questions) is referenced without a closing keyword; cli#340 was already closed by Bundle Stage 4.79.1 and Screenplay 4.145.1: admit ESM v11–v13, model notes, empty scopes, Copilot adapters #342.