Release: publish and qualify Board clarity v1.4.2

[jeffhuber]

Part of #945 and roadmap #900.

v1.4.2 Board clarity release record

v1.4.2 is published and qualified from merge/release commit 55339bf1acf76d33be5937e80bdaad772e0b2bf5.

• Release PR: Prepare v1.4.2 Board clarity release source change #1006, exact reviewed head 32706cf5a01af5863d6c713b83dfb196efde6d4c
• Independent Codex audit: PASS, P0/P1/P2=0
• CI: run 35188065537, PASS
• PyPI publish: run 35189302150, PASS
• Release verification: run 35189721623, PASS; publication jobs were intentionally skipped
• Wheel SHA-256: f8bf24dd8a982ed5ab28302e837cd5d2aeece6d984ed1c44fcb4688c3fb7a522
• sdist SHA-256: aff202eea9748ab3734ea6b90ba3b48ea5aea1e21ae87fba03b77b64d5cdec42
• Cold install and 1.4.1-to-1.4.2 upgrade: PASS
• Both known local Board services: safely restarted and verified with serving and installed version 1.4.2

Acceptance

• Required Board implementation children merged with exact-head review, validation, CI and gate.
• Current documentation distinguishes local Board visibility from future Slack/cloud mapping.
• Clean source, wheel, production PyPI, cold-install and upgrade rehearsals passed.
• Git tag, GitHub Release and package artifacts bind the release identity.
• All known Board services at release time were safely restarted with preserved bindings.
• Board doctor and local installed-package qualification passed.
• No new cloud field or metadata upload was required for this release.
• Release: qualify and publish Slack session ingress in v1.5.0 #923 records v1.4.2 as the accepted Board dependency for final Slack qualification.

#951's bounded hosted Devin observation remains a separately authorized follow-through item. This release did not run or claim that canary and did not infer provider spend or exit evidence.

[jeffhuber]

Work Order: prepare the v1.4.2 Board clarity release

Base this serial release change on current main at 6501feb4185e98c971b93dac18f46c37514bee79. Named builder: Code Mower Claude, single writer on branch claude/952-v142-release. Produce one focused draft PR linked to #952. Do not tag, publish to GitHub/PyPI/TestPyPI, restart installed Board services, run paid hosted sessions, or apply cloud uploads; those release mutations remain with the orchestrator after exact-head acceptance.

Prepare the reviewable source change for v1.4.2: version and changelog/release notes/current docs, package/release qualification contracts, clean source and wheel rehearsal, cold-install and 1.4.1-to-1.4.2 upgrade coverage, installed-version/Board doctor and three-service restart verification guidance, published-package canary instructions, and dry-run-first allowlisted metadata upload guidance. Current docs must distinguish local Board visibility from future Slack/cloud mappings and incorporate the accepted v1.4.0 adoption lessons where relevant. Do not add or change cloud event fields.

Treat #951's merged code evidence as accepted but its bounded hosted Devin canary as still pending. The release PR may prepare/check the canary contract, but must not claim the hosted result or close #951. Preserve #976's independent evidence distinctions: reviewed commit, provider exit, authorized versus settled spend, upload receipt, and aggregate freshness remain separate.

Run focused and relevant tests, package/release rehearsals, workflow/privacy checks, commit and push the branch, open a draft PR with Closes #952, record the exact test evidence and remaining orchestrator-owned release actions, request the independent Codex audit label, and stop without merging.