Ship verified API migration pipeline and campaigns

[kam6l]

Summary

• consolidate API migrations around the real ProofEngine and integrity-bound certificates
• add fail-closed OpenAI Chat Completions → Responses support, untrusted generator capture, safe provider intelligence, and exact-patch PR delivery
• add Verified Campaigns for independently proving one upstream change across explicit repositories
• replace MkDocs with the separate React documentation site at https://agentdiff.usernameort.chatgpt.site/docs
• refresh CI, CodeQL, release automation, demos, and version 0.4.0 packaging

Validation

• 392 passed, 2 skipped locally (the two opt-in Docker integration cases)
• real Docker generic proof and supported OpenAI migration proof passed in GitHub CI
• Ruff format/check clean
• mypy clean across 117 source files
• pip-audit: no known vulnerabilities
• Bandit: no medium/high findings
• wheel/sdist metadata and contents validated
• clean Python 3.12 wheel install and fail-closed unsafe-worker smoke passed
• all required PR checks green

Release status

Ready for maintainer review and merge. PyPI publication remains an explicit release action through the trusted-publishing workflow.