Prepare sealed 0.4.0 realm launch

[ael-dev3]

Summary:

• preserve Genesis 001 admissions permanently on exact 0.3.43
• add sealed Genesis 002 at 0.4.0 with zero admissions and zero player access
• add an owner-only PTR at 0.4.0-ptr.1
• add the professional realm selector with admitted/not-admitted marks and tooltips
• suspend all new admission and notification paths for the sealed launch
• add fail-closed production publishers, import operators, receipts, activation tooling, and workflow gates

Safety:

• preparation main remains inert and cannot deploy Pages
• the historical Genesis 001 freeze is adopted, never republished
• G002 and PTR must be fresh identities and remain private until receipt-bound activation
• applicant data stays in owner-private Desktop/audit files and never enters Git or CI
• public PTR bindings expose zero private tables or owner identity

Verification:

• root typecheck/build, auth-bridge checks, 598 backend authority tests, G002/PTR builds, audits, gitleaks, workflow pinning, public-boundary checks, and the 997-member tamper-evident closure are green
• final clean-checkout application suite and independent adversarial review are running in parallel with required PR checks

Deployment:

• merge this preparation first; it intentionally classifies Pages as blocked
• perform receipt-bound bridge/G002/PTR production operations from protected main
• land a three-file activation successor, then allow Pages to deploy 0.4.0 only after every gate passes