release: prepare DocMergeForge 2.8.5 candidate

[sanskarIN]

Scope

Prepare DocMergeForge for version 2.8.5 without converting unobserved release gates into production claims.

Changes

• align Project Sync Safety with actions/checkout@v7 and actions/setup-python@v7;
• set package metadata to 2.8.5;
• expose runtime __version__ = "2.8.5";
• pin the candidate version in metadata regression coverage;
• correct PROJECT_STATE.md so the Recent Projects synchronization shortcut is recorded as completed;
• update what_changed.md with the 2026-08-24 continuation and exact release-preparation commits;
• update release policy so candidate versioning remains separate from CI/package/human/production acceptance evidence;
• repair CI-discovered Black/Ruff/test-fixture/workflow issues without weakening maintained checks;
• ensure regression and Quality invoke tests with repository-safe python -m pytest and install web extras where integration coverage requires them.

Evidence boundary

This PR intentionally does not claim a passing current-head Quality, Project Sync Safety, Build Smoke, package, browser/device, accessibility, fidelity, signing, notarization, or production gate until the corresponding run/acceptance evidence is observed for the exact candidate head.

Supersedes

The workflow action-major changes cover the same remaining lines proposed independently by Dependabot PR #3 and PR #4. Those PRs can be closed as superseded after this release-preparation line is accepted.