Refresh release scope references and isolate playground builds

[proddata]

Summary

• replace stale Milestone 1 wording with the active strict JWT release scope
• record completed candidate-head evidence while keeping human approval and publication explicitly deferred
• prevent PostgreSQL 19 build artifacts from contaminating PostgreSQL 18 playground images

Trust boundary and failure behavior

The validator security policy is unchanged. The playground now recursively excludes compiled host artifacts and cleans the copied source tree before building, ensuring each image is compiled against its selected PostgreSQL major. Invalid or unavailable validation inputs continue to fail closed.

User-visible and compatibility effects

Auth0 Node playground connections on PostgreSQL 18 no longer fail because of unresolved PostgreSQL 19-only HBA symbols. The documented stock psql/Auth0 discovery limitation is unchanged. PostgreSQL 19 remains preview-only.

Verification

• rebuilt pg-oauth-validator-playground:pg18 from the working tree
• confirmed the PG18 module does not import GetOAuthHBAOption or RegisterOAuthHBAOptions
• make verify passed inside the PG18 playground image
• make integrationcheck passed: 20 passed, 2 skipped
• playground/tests/auth0-playground.sh passed
• live Auth0 delegated-role connection succeeded as app_writer
• git diff --check passed

Rollout and rollback

Rebuild the playground image normally. Rollback is the previous Containerfile and dockerignore behavior; no database, configuration, or module API migration is involved.

Remaining risks

The live Auth0 test covered the Node client. Stock psql still fails during Auth0 discovery as already documented and does not reach the validator.