release: ship Goal Contract v1 in AAA 0.17.0

[fantasyce]

Summary

• ship the independently designed Goal Contract v1 and Across Goal projections across host APIs, persistence, provider/Orchestrator execution, Swift UI, evidence review, and human decisions
• bind stale-evidence revalidation and replacement attempts to immutable Goal revisions and verified approval receipts
• pin the producer-first release train: Orchestrator 0.12.2, Context 0.12.0, and Autopilot 0.6.0
• preserve task identifiers through public Worker projections while redacting standalone credential tokens
• harden destructive result rejection confirmation, microphone permission timeout recovery, plugin/runtime boundaries, and final release evidence
• provision the pinned Orchestrator source in Quality CI so real-provider tests do not depend on a developer worktree layout

Acceptance

• formal vNext aggregate: passed and release_authorized=true
• AAA backend: 1564 passed
• Orchestrator: 361 passed, 2 optional skips; 14 subtests
• Context: 134 passed
• Autopilot: 230 passed
• Swift behavior, build, and tests: passed
• fixture/sandbox E2E, packaged runtime, cross-plugin lifecycle, release-train lock: passed
• live Kimi E2E on the final installed App: minimal 4/4, REST 5/5, complex multi-wave 4/4, legacy socket 5/5
• real Worker 0.12.2: verified receipt, artifact hashes, cleanup, reconnect, and stale-lease quarantine passed
• final installed App 0.17.0: mouse UI sweep, Goal review task/Decision Mark, approval receipt chain, language/theme/motion/window variants passed
• Quality CI: https://github.com/fantasyce/across-agents-assistant/actions/runs/33322904048
• CodeQL: https://github.com/fantasyce/across-agents-assistant/actions/runs/33322904046

Evidence boundary

• GitHub-hosted Live E2E dispatch: https://github.com/fantasyce/across-agents-assistant/actions/runs/33322551204
• the dispatch correctly failed before execution because the repository has no model secret and no self-hosted/local Agent route; no local provider credential was uploaded and no real-route assertion was weakened
• replacement release evidence is the completed real Kimi run recorded in the final installed-App release report
• remaining real-microphone edge paths are explicitly waived by the product owner; Chinese and English core microphone paths were observed, and this PR makes no full hardware-coverage claim
• synthetic beginner evidence is a simulation, not human research