Merge pull request 'reconcile: V1R4C5 baseline metadata (current.json + V1R4C5.json)' (#5) from reconcile/v1r4c5-baseline-metadata-20260711 into main

Root cause:
The V1R4C5 baseline promotion commit (a32c76a) was made on a feature branch
that was never merged to main. As a result, both baseline/current.json and
versions/V1R4C5.json on main still reflect V1R4C3 state. Runtime
getBaseline() continues to return V1R4C3 with commit f5435e3.

Changes:
- baseline/current.json: update current_baseline -> V1R4C5, git ->
  a32c76a3c1 (the actual promotion commit),
  add constraints from the original promotion
- versions/V1R4C5.json: create the missing version metadata file with status
  active-baseline, referencing V1R4C5 tag (object ac9bdac...)

Why this does not affect V1R4C5 release content:
- V1R4C5 release documents (docs/releases/*.md) are untouched
- V1R4C5 tag is unchanged and not moved
- No V1R4C6 functionality introduced
- No memory search or vector index enabled

Rollback method:
  git revert <this commit hash>
  # Or restore baseline/current.json from V1R4C3 content:
  # git checkout main~1 baseline/current.json
  # And delete versions/V1R4C5.json:
  # git rm versions/V1R4C5.json
  # Then commit the revert

Constraints honored:
  - No direct writes to main (using PR)
  - No force push
  - V1R4C5 tag not moved/rebuild
  - No V1R4C6 content
  - Memory search remains disabled

baseline/current.json

@@ -1,8 +1,13 @@
 {
- "current_baseline": "V1R4C3",
- "previous_baseline": "V1R3C1",
- "promoted_at": "2026-07-09T17:44:57+08:00",
- "git": "f5435e308794c737f3e39de3f6b79807486943c3",
- "promoted_by": "openclaw",
- "promotion_reason": "V1R4C3 autonomous operations, search gateway, task center, owner gate, and blocker self-optimization baseline promotion"
+ "current_baseline": "V1R4C5",
+ "previous_baseline": "V1R4C3",
+ "promoted_at": "2026-07-11T02:17:31+08:00",
+ "git": "a32c76a3c1baa49562e53fb8adce10a5ed0e6704",
+ "promoted_by": "openclaw/admin",
+ "promotion_reason": "V1R4C5 reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search remains disabled",
+ "constraints": {
+   "memory_search_enabled": false,
+   "force_push_allowed": false,
+   "gitea_db_mutation_requires_owner_approval": true
+ }
 }

versions/V1R4C5.json

@@ -0,0 +1,38 @@
+{
+    "version": "V1R4C5",
+    "codename": "C5 reliability-security-admin",
+    "status": "active-baseline",
+    "tag": "V1R4C5",
+    "tag_ref": "refs/tags/V1R4C5",
+    "tag_object": "ac9bdacb19ff66cba8046d75358866f0f0fffb82",
+    "previous_version": "V1R4C3",
+    "rollback_version": "V1R4C3",
+    "baseline": "V1R4C3",
+    "release_reason": "reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search disabled",
+    "purpose": "stabilize autonomous operations, enforce user isolation gate, prepare admin workbench read-only for C6",
+    "changes": [
+        "reliability: idle container GC with nixos-activate fallback retention policy and CI reset",
+        "watcher: remove redundant local async watcher, consolidate to server-pushed events",
+        "security: user data isolation gate (read-only admin panel, fb isolation check)",
+        "admin workbench: read-only preparation layout for V1R4C6 admin-search integration",
+        "governance: final owner approval via Owner Gate Web UI"
+    ],
+    "artifacts": [
+        "VERSION",
+        "docs/releases/V1R4C5-acceptance-evidence.md",
+        "docs/releases/V1R4C5-final-owner-approval.md"
+    ],
+    "validated_actions": [],
+    "secret_plaintext_written": false,
+    "owner_approval_required": true,
+    "owner_notification_channels": ["wechat", "web_ui_audit"],
+    "constraints_original": {
+        "memory_search": "remain disabled",
+        "sr04": "disable read-only visibility slice if RBAC or isolation check fails",
+        "gitea": "enter autonomous safe mode if branch consistency drift detected"
+    },
+    "promoted_at": "2026-07-11T02:17:31+08:00",
+    "promoted_by": "openclaw/admin",
+    "created_at": "2026-07-11T01:40:00+08:00",
+    "author": "openclaw"
+}