feat: add operator messaging and prepare v0.6.0

[brainx]

Operators can submit explicit asynchronous jobs to an owned Hermes 0.21 gateway with zeus message send/retry/status/cancel/release/list. The opt-in message-bot template carries finite turn and API concurrency limits, launch markers bind the active profile policy, and network operations recheck the target process generation.

Depends on #42 and targets feat/live-gateway-diagnostics.

Durable receipts commit with SQLite FULL before dispatch. Unknown acknowledgements block new jobs; explicit retries reuse the same upstream key and exact input within a bounded window. Leases and version checks reject overlapping or stale attempts. Receipts survive bot deletion and retain request-key tombstones, without persisting input, output or API credentials. File/stdin input and authenticated loopback responses are bounded; mutations are never automatically retried.

Acknowledged runs whose results expire or exceed the response limit now have an explicit recovery path: message release --acknowledge-unknown-outcome records a local release without cancelling or resubmitting the run or claiming completion. Later status/cancel observations retain the release. Unknown/prepared dispatches cannot be released. Oversized replies return response_too_large, and failed cancellation requests preserve the last confirmed status timestamp.

Validation

• make release-check passed in an isolated editable environment: two runs of 1,539 tests with three expected skips, 83.90% combined production statement/branch coverage, repository contracts, Ruff, mypy, Bandit, ShellCheck, dependency checks, wheel/source build, installed-wheel smoke, Twine and checksums.
• Targeted tests cover ambiguous acknowledgements, retries, leases/version races, process/configuration/credential changes, expired and oversized result recovery, release/observation races, retained request keys, migration preservation/rollback, pagination and HTTP deadlines. Real loopback tests verify bounded reads for oversized status and stop responses across Content-Length, EOF and chunked framing.
• The CI lock includes the upstream API adapter's aiohttp==3.14.3 and required dependencies. The original 64 package/version/hash entries remain unchanged; eight added wheels and their dependency constraints were verified. Zeus core remains dependency-free.
• All nine push CI jobs and nine PR CI jobs passed for f3c56d2, including the real Hermes runs/durable replay contract, gateway diagnostics, audit broker, Docker isolation, service recovery/restore and Linux/macOS lifecycle checks.
• The preview build checksums were verified; all 121 wheel package files and 207 included checkout files match the commit.

Compatibility

Schema 8 adds receipts; schema 9 adds nullable release timestamps and updates the active-receipt index, preserving existing records. Normal startup migrates state; messaging commands do not. Back up the database and profiles before upgrading. Older binaries reject newer schemas; rollback requires the pre-upgrade backup. Readiness now reports schema 9.

Existing profiles remain disabled by default. Enabling messaging requires profile-local credentials/opt-in and a gateway restart; changes to configuration, SOUL or credentials require another restart before sending. Status/cancellation remain available after opt-out with a verifiable original target. No Zeus HTTP messaging route is added.

Release does not stop an executing job or recover unavailable output. A subsequent independent send remains subject to Hermes admission. Cancellation is cooperative, approval requests are status-only, and existing Hermes tool privileges and provider costs apply. Turn limits are not a hard deadline or spending budget; local suspension and upstream persistence failures prevent an exactly-once external-effects guarantee. See docs/MESSAGING.md for setup and recovery.

This stacked PR also includes the version, release-gate and HTTP cleanup changes from #44. Its combined file tree is identical to validated release candidate 2d70de386548a0bba9c3852b840423173a48d8c1, which passed all 18 CI checks. The stack is being combined on feature branches; promotion into main will require fresh CI on the combined branch.