Release Server v1.6.462 permission matrix fixes - #155

Outcome

Packages Orchestration Engine v0.183.319 and Web Console 1.6.126 into immutable Server v1.6.462.

• makes shared Default membership atomic without weakening existing roles
• supports authenticated zero-environment state and authoritative display-only identity links
• documents and gates the exact direct/group permission matrix
• binds the final CycloneDX root to the OCI image purl and manifest digest, including dependency graph references

Verification

• Server source gates: 56/56 passed
• Engine focused authorization tests: 17 passed, including 100-iteration deterministic barrier
• Web Console browser tests: 536 passed
• release workflow performs exact candidate smoke, restart, security, SBOM, provenance, and immutable release checks

QA deployment and the fresh Authentik browser matrix will run only after the immutable image is published. Production is out of scope.