feat(devkit): add resumable workspace automation and UI review tooling

Verified with the coordinated workspace changes by devkit full run
2026-09-08T225814-186389-0000-3e3ed7cd (all seven phases passed).
This shared UI pass does not mark the individual module reviews complete.

docs/operations/RELEASE_CONSOLE.md

@@ -354,8 +354,17 @@ such as `0.2.0` or `0.2.0-alpha1`, but requires the first three version numbers
 to move forward.
 
 Plain repository pushes are separate from catalog publication. `Preview Push`
-shows the selected repository push commands. `Push Selected` requires `PUSH` in
-the repository push confirmation field.
+shows the selected repository push commands, but generic push, sync and prepare
+mutation endpoints are disabled: they require a separate durable, receipt-bound
+maintenance workflow and cannot be enabled by typing a confirmation. Source
+release branch/tag publication uses the durable release-run steps described
+above; do not route ordinary dirty worktrees through the legacy all-repository
+stage/commit/tag helper.
+
+The [headless devkit release commands](DEVKIT_RELEASE.md) invoke this same
+application in-process without starting a server. They expose selective planning,
+bounded status/history, create/show/preview/execute and explicit recovery while
+retaining the same request IDs, confirmations, source bindings and receipts.
 
 The source release panel retains `Preview Tag + Publish` as a non-mutating
 inspection. Its legacy `Create Tags` and `Publish Tags` controls stay visible