feat(release): self-determination - ensure at launch, drift warnings, M20 packages/* decision (#38)

- release.sh ensure: aligned no-op; drift -> package-if-needed + health-gated
  activate (M3 gate-then-flip, automated)
- ensure_release_aligned in common.sh: invoked by hello/verify/agent;
  MOSAIC_ENSURE_SKIP guards recursion; run-task warns on drift without
  auto-aligning (workers/suites never trigger builds or model gates)
- ROADMAP: M20 decision recorded - v2 adopts packages/* monorepo at usurpation
- BUILD-LOG Phase 20 + tool-race process note

Live-verified: post-reset pointer loss auto-restored via health-gated
ensure; drift warning fires on desired-version bump; idempotent no-op on
aligned state.

Closes #38

scripts/release.sh

@@ -140,10 +140,29 @@ cmd_rollback() {
     activate "$prev_release" "$prev" "rollback"
 }
 
+cmd_ensure() {
+    # M16 release self-determination: the system determines what is installed
+    # and aligns itself. Aligned (pointer == RELEASE, image present) -> no-op.
+    # Drifted -> package if needed, then health-gated activate.
+    local pointer="$MOSAIC_DEV_DIR/state/active.json"
+    local active=""
+    if [ -f "$pointer" ]; then
+        active="$(node -e 'try{const p=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));process.stdout.write(p.release||"")}catch{}' "$pointer")"
+    fi
+    if [ "$active" = "$MOSAIC_RELEASE" ] && image_exists "$MOSAIC_IMAGE_TAG"; then
+        echo "release: aligned at $MOSAIC_RELEASE ($MOSAIC_IMAGE_TAG)"
+        return 0
+    fi
+    echo "release: drift (active: ${active:-none}, desired: $MOSAIC_RELEASE) - aligning"
+    image_exists "$MOSAIC_IMAGE_TAG" || cmd_package
+    activate "$MOSAIC_RELEASE" "$MOSAIC_IMAGE_TAG" "activate"
+}
+
 case "${1:-}" in
     package)  cmd_package ;;
     activate) shift; cmd_activate "$@" ;;
     rollback) cmd_rollback ;;
     status)   cmd_status ;;
-    *) echo "usage: scripts/release.sh package | activate [--fault-injection] | rollback | status" >&2; exit 4 ;;
+    ensure)   shift; cmd_ensure "$@" ;;
+    *) echo "usage: scripts/release.sh package | activate [--fault-injection] | rollback | status | ensure" >&2; exit 4 ;;
 esac