Align v1.1.0 release boundary metadata

[GsCommand]

Motivation

• Narrow the canonical shipped package surface to the v1.1.0 line only and remove any repo prose or tooling that could imply broader or already-published package contents.
• Avoid overclaiming publication or provenance by softening manifest/publication fields until an external release step occurs.
• Centralize the release boundary in a single machine-usable constant so checksum, integrity, example, and tarball checks all enforce the same authoritative scope.

Description

• Softened manifest.json to status: "current-draft", set release_date to null, and added publication_state: "repository-validated-not-yet-published" to avoid implying completed publication.
• Added scripts/release-boundary.mjs with canonical constants and wired it into scripts/generate-checksums.mjs, scripts/validate-integrity.mjs, scripts/validate-examples.mjs, and scripts/validate-all.mjs so all tooling derives scope from a single source of truth.
• Introduced scripts/check-packed-surface.mjs and added validate:pack to package.json and CI to assert that npm pack --dry-run contains only the canonical shipped boundary plus the npm-emitted package.json metadata.
• Updated documentation and policy files (README.md, POLICY.md, SPEC.md, SECURITY_PROVENANCE.md, ONBOARDING.md, releases/v1.1.0.md) to consistently describe v1.1.0 as the current shipped boundary, v1.0.0 as repository-only history, checksum/integrity scope, and repository pre-publication posture; regenerated checksums.txt to match the new canonical checksum-covered surface.

Testing

• Ran the full validation suite with npm run validate (which now includes validate:schemas, validate:examples, validate:integrity, and validate:pack) and it completed successfully.
• Executed node scripts/generate-checksums.mjs and node scripts/validate-integrity.mjs to regenerate and verify checksums.txt, and both succeeded.
• Verified example fixtures with npm run validate:examples and schema-level validation with npm run validate:schemas, both of which passed.
• Performed npm pack --json --dry-run and the new validate:pack check validated the tarball contains only the canonical v1.1.0 surface plus package.json, and git diff --exit-code -- checksums.txt showed no unexpected changes.

---

Codex Task