chore: release GraphAgent 1.0.45

[LeXwDeX]

Why

Deliver the blocked-workflow diagnostic and bounded recovery fix to the stable GraphAgent channel as 1.0.45.

What changed

Promote the workflow fix from #600 and release-note formatting correction from #604 to main. The source head is 49853e166f329519d4d10957e8c97275f39d49e3; it contains the fix, regression tests, engineering report and shared 1.0.45 release notes.

Closes #601

Evidence

• Fix PR fix: surface blocked workflow errors after bounded recovery #600 passed current-head Typecheck, full unit/config-assistant/generated-client/HttpAPI gates, Linux and Windows E2E, and CodeQL before merging to dev. Issue fix: surface blocked workflow errors after bounded recovery #599 is closed.

• 104 focused workflow/schema/TUI tests, 29-package typecheck and lint passed locally.

• GPT-6 source-runtime replays passed for unavailable-model reporting with zero workflows and for authorized configuration recovery through completion and parent wake/report.

• The actual source TUI shows workflow: blocked and model.unavailable with both detail toggles disabled.

• The first dev build passed but Release creation failed on the notes format. fix: conform release notes to the renderer contract #604 corrects the shared series notes; the production renderer now accepts both dev and main output.

• Downloaded macOS build artifact: all 6 installer checks passed; version is 1.0.45-dev.1; the actual packaged TUI exposes blocked/model.unavailable with both detail toggles off; a real GPT-6 recovery replay completed and woke the parent with ACCEPTANCE_OK.

• Published dev Release 1.0.45-dev.1 at 4b554abd9dac6ae93c46b555b60dcb478eff7be6 passed independent re-download checks: all 3 assets match SHA256SUMS/native digests, all 6 macOS installer checks pass, packaged TUI shows blocked diagnostics, and GPT-6 recovery completed with parent report.

• The release candidate and deployed dev commit have identical Git tree 58c08135edc27c59a4db16e6f9db7328838442f6. All current-head native checks, including Linux/Windows E2E, passed; GitHub reports CLEAN.

• The two-attempt recovery bound is an agent-facing instruction contract, not a durable runtime counter.

• Stable 1.0.45 was published as Latest from main 7ac4570359def3ac915035000f2de1c4d5cb47f5. All 5 downloaded assets match native SHA-256 digests; archive entries match SHA256SUMS. All three platform builds and 6 macOS installer checks passed.

• The downloaded stable binary reports 1.0.45. Its actual TUI exposes blocked/model.unavailable with both detail toggles off. A fresh GPT-6 runtime replay completed the authorized recovery path and woke the parent with ACCEPTANCE_OK.

• Main post-merge automatic full CI passed on 7ac4570359def3ac915035000f2de1c4d5cb47f5, including full unit/HttpAPI and Linux/Windows E2E (run 34829367792). The Latest release and native asset digests were rechecked after CI completed.

Checklist

• Promote the exact verified dev content and link the release Issue.
• Dev prerelease artifact integrity, macOS installer, TUI and runtime acceptance.
• Main-target current-head required checks and full E2E.
• After merge: publish main as Latest and verify all three platform archives plus macOS runtime.