feat: prepare v0.1.23 release (docs truth pass, ledger audit, changelog)

[acidkill]

Release preparation for v0.1.23, plus the requested documentation and ledger work.

Documentation truth pass (VCR409 companion)

• README.md: version-accurate current state — the installer ships five bundled skills (was documented as four), the three explicit coding-decision commands, the typed-decision cache; all "source checkout / not in published v0.1.22" phrasing converted to "published since v0.1.23"; every unverified-benefit caveat preserved; new 0.1.23 entry in the verified-evidence list.
• ROADMAP.md: 0.1.23 candidate/release-evidence section; header updated.
• RELEASE_NOTES.md: the seven formerly "Unreleased … (no package release)" sections retitled "Included in v0.1.23", with a superseding v0.1.23 header noting their distribution statements described v0.1.22 and earlier.
• CHANGELOG.md (new): canonical per-release changelog with the full 0.1.23 change list, evidence boundaries, and verification scope; pyproject Changelog URL repointed to it.

PILOT/TASKS ledger gaps (VCR409)

• Full VCR numbering audit: 27 identifiers (VCR278…VCR406, listed in the entries) are confirmed unused — absent from both ledgers, all commit subjects, and every tracked file — so they are unused identifiers, not lost records. The sole asymmetry (VCR283, PILOT-only) is recorded with its resolution. No frozen result, gate, or score changed.

Release prep (VCR410)

• Version bumped to 0.1.23 in pyproject.toml and __version__.
• tools/check_distribution.py expected-skill set fixed to enumerate bundled_skills/*/SKILL.md (five skills) instead of the stale two-name list — it was rejecting a correct wheel.
• Local gates at this revision: 858 tests OK (Linux), git diff --check clean, uv build + tools/check_distribution.py pass. Registry rechecked: latest published is 0.1.22, 0.1.23 unused.
• After merge: tag v0.1.23 → dispatch the pypi.yml workflow from the tag (suite + build + distribution check + Trusted Publishing) → GitHub release → receipts appended to the ledgers.

No trial was run; no efficacy, delivery, or platform claim is made.