release: prepare Qarinah 0.1.7

[AjnasNB]

What changed

• prepares the already-reviewed launch-directory badge tree for release as qarinah@0.1.7
• synchronizes package, runtime constant, declarations, MCP/server manifests, host-plugin manifests, software citation metadata, install pins, and trusted-publish defaults
• keeps the committed 0.1.6 benchmark and white-paper evidence immutable, while making deterministic continuation and multifile replay checks identify that evidence explicitly as historical
• regenerates the Codex and Claude Code plugin bundles; their only generated changes are the 0.1.7 banner and version constant

Why

The website deploy is intentionally fail-closed: it accepts only an exact main commit that has first completed the trusted npm publish workflow for the same package version. The merged directory badges therefore need a real reviewed patch release rather than a site-only bypass.

Contract and security impact

• No public runtime behavior, schema, trust boundary, benchmark result, paper, product claim, or page layout changes
• The exported QARINAH_VERSION and corresponding type literal advance to 0.1.7
• Historical 0.1.6 evidence remains byte-identical and is not relabeled as 0.1.7 evidence
• Trusted npm provenance and exact-commit site deployment remain mandatory

Verification

• npm ci --ignore-scripts
• npm run check
• 182 / 182 tests passed
• 25-page site build/check passed
• Codex and Claude Code MCP smoke reported 0.1.7
• clean-consumer/typecheck passed
• npm package dry-run produced qarinah-0.1.7.tgz
• no benchmark artifact, white paper, runtime-logic, or layout file changed

Documentation

• Current-version install examples and machine-readable software metadata are synchronized
• The v1.4 paper continues to identify its implementation as Qarinah 0.1.6
• No secrets, private context, hidden reasoning, or third-party material are included

Contributor certification

• Commit includes a Developer Certificate of Origin sign-off

Branch migration

This PR replaces #98 only because its legacy head ref used the retired �gent/ prefix. The source tree and commit history are unchanged: $(System.Collections.Hashtable.oldBranch) and $(System.Collections.Hashtable.newBranch) both point to exact head $(System.Collections.Hashtable.sha) at migration time. Review and merge protection remain required.