Toolkit 0.8.5: provider diagnostics and OCR 1.10.2

[xeonvs]

Summary

• Add one bounded provider-neutral CI diagnostic line from a fully validated ocr.llm-retry-report/v1, while keeping the GitLab summary, DLP, receipt, telemetry, findings, and approval contracts unchanged.
• Qualify and pin OCR 1.10.2, including Solidity/Vyper Rules, grouping-cap behavior, and human review for feature-bearing patch releases.
• Move daily OCR compatibility discovery to 07:15 UTC with exact-tag manual recovery.
• Reconcile public configuration, operations, security, compatibility, examples, strategy, backlog, and test evidence.

Validation

• scripts/quality.sh check: 1,296 tests + 337 subtests, 86.51% branch coverage; risk groups 85%, 82%, 86%, and 87%.
• 78 current release-contract tests; focused provider, posting, privacy, OCR compatibility, and documentation suites.
• Ruff, strict MyPy, Bandit, OCR manifest validation, lock check, Towncrier draft, pinned Gitleaks, git diff --check, and public-diff privacy scan.
• Hosted OCR 1.10.2 qualification: run 33055459209; exact release assets and consumed contracts passed, with feature-bearing release notes routed to human review.
• PATH-effective OCR 1.10.2 and official Darwin arm64 checksum verified.
• Local semantic OCR review was attempted at concurrency 2 and retried at concurrency 1. Both runs failed before generation with only HTTP 429 responses, zero tokens, and zero findings. Per owner instruction, this external provider gate is explicitly waived for v0.8.5; it is not reported as a passing review.

Release scope

Target toolkit version: 0.8.5.

Tracks #149 and #151. Stable publication and issue closure remain owned by the separate protected Release v0.8.5 PR and release workflow.