Keep historical outcomes out of live activity and document rollout gates

[kai-linux]

Follow-up to #358 after real dashboard deployment and reconciliation of issue #355.

• Pin reviewed Proof 0.2.1 (proof#3): historical reconciliation cannot inflate live activity; duplicate outcome events count once.
• Add a real HTTP integration regression preserving historical proof without inventing current delivery.
• Document immutable runtime approval, separately deployed read-only monitoring, and missing GitHub Project authorization; retain the deployment guard and dispatcher-only setting.

Validation: 795 Agent-OS tests passed against the installed pinned Proof wheel; 45 Proof tests passed; changed-file Ruff and diff checks passed. The localhost-only dashboard is running independently. Autonomous controller rollout still awaits explicit approval of the execution pin; Project projection awaits an account authorization. No cron or execution settings changed.

[kai-linux]

Self-review complete: the dependency points to the merged Proof fix, the real HTTP regression checks both historical visibility and absence from live rates/activity, and deployment documentation matches the actual immutable autopull guard. No execution code, permissions, token values, cron schedules, or approved SHA are changed here. 795 local Agent-OS tests and 45 Proof tests passed; changed-file Ruff passed. Runtime activation remains an explicit approval, separate from this read-only dashboard rollout.

[kai-linux]

Deployment verification: the read-only localhost:8765 service now runs immutable release 44d327e with its own installed Proof 0.2.1 environment. Service restart succeeded, all 7 dashboard tests passed in that exported release, and the real browser/API show one reconciled historical outcome with zero invented live delivery activity. Finished development worktrees have been removed.

Execution checkout remains clean at the existing approved dc45597; the approval pin was not advanced. The dashboard correctly exposes the stale new-coordinator heartbeat and pending GitHub Project notifications. Activating the execution release still needs the requested deployment approval, and Project projection needs the runtime account owner to restore OAuth project access. No simulation has been inserted into operational data.