feat(release): prepare sealed Genesis 002 launch for 0.4.0

[ael-dev3]

Release contract

• preserve admitted Genesis 001 players on the frozen 0.3.43 realm
• add the Genesis 001 / Genesis 002 realm chooser with admitted and not-admitted status marks and tooltips
• keep Genesis 002 sealed with zero admissions and zero player access
• suspend all admission and access-request paths before activation
• prepare private applicant census export, frozen G1 publisher, private G2 publisher/import, and guarded activation receipts
• keep the public Pages release blocked in this preparation phase; the 0.4.0 version bump and Pages activation happen only in the receipt-bound successor

Local verification

• complete root suite: 5,273 tests passed across bounded serial shards
• Spacetime pure suite: 598/598 passed
• clean-tree release shard: 55 files / 512 tests passed
• private Genesis 002 loopback: 3 consecutive passes
• closure/policy: 952 exact signed members
• root and Spacetime typechecks/builds passed
• production Vite build and public-boundary checks passed
• two independent final reviews: approved, no blockers

Production remains unchanged until required GitHub checks pass and the guarded operational sequence completes.

Supersedes #222 with an exact-tree-identical, GitHub-verified signed commit required by protected-main policy.