docs: record workspace actor gate merge

[yha9806]

Summary

• record vulca-platform PR Add privacy-safe opt-in telemetry for real usage signals #37 / merge 0faf8748 in the protected review context vault
• update Workspace durable status, source index, M5 closeout, release gate, production persistence spec, and manifest
• preserve the boundary that PR Add privacy-safe opt-in telemetry for real usage signals #37 is a trusted-header compatibility gate, not full user/JWT authorization or repo membership authorization

Verification

• python3 docs/review-context/gates/validate_review_context.py
• python3 -m json.tool docs/review-context/MANIFEST.json
• python3 -m json.tool docs/review-context/release-readiness/m5-closeout-summary.json
• git diff --check
• gemini-agent diff-review --stdin

Boundary

Product-level R5 remains blocked. Remaining blockers include full user/JWT auth, repo membership authorization, typed Workspace aggregates, release-owner human audit semantics, operation-specific writes, ingress header-stripping proof, and multi-instance acceptance evidence.