chore: promote 0.19.0 to prod

[klappy]

Promote 0.19.0 to prod.

Includes P1.3.1 oddkit_challenge governance_source retrofit (merged via #116, squash SHA 71ee6ed).

Verification

• Main-preview smoke vs https://main-oddkit.klappy.workers.dev/mcp: 126/126 × 5 consecutive clean runs
• Sonnet 4.6 validator (agent_011CaE62pg6jJ7yYpRj1o9Do / sesn_011CaE63LZhPUX1UAZPbiV7n): VERIFIED 5/5, zero blockers, zero advisories
• Parser regression: 105/105
• Typecheck: clean

What ships

• oddkit_challenge envelope declares governance_source (knowledge_base | minimal, two-tier per current baseline reality) and governance_uris (plural array of 4 peer canon URIs — intentional divergence from encode's singular governance_uri, see feat(challenge): governance_source envelope + peer governance_uris (0.19.0) #116 for rationale)
• Same update lands on both SUPPRESSED (voice-dump) and CHALLENGED return paths
• debug.knowledge_base_url echoes override on challenge responses

---

Note

Medium Risk
Adds new response fields to the oddkit_challenge envelope and refactors how governance data is fetched/cached, which can break consumers and affect runtime behavior when canon files are missing or overrides are used.

Overview
Promotes version to 0.19.0 and documents the release in CHANGELOG.md.

oddkit_challenge responses now include result.governance_source (aggregated across four governance fetches) and result.governance_uris (array of 4 peer canon URIs), emitted for both CHALLENGED and SUPPRESSED paths; debug.knowledge_base_url now echoes the override.

Internally, challenge governance loaders were refactored to return {<domain>, source} tuples with per-dimension source caching/reset, and smoke tests were extended to assert the new envelope fields plus 9-mode coverage.

^{Reviewed by Cursor Bugbot for commit 71ee6ed. Bugbot is set up for automated code reviews on this repo. Configure here.}