release: prepare 0.2.5854 security fixes

Authenticate Unix CLI peers and notification files, harden policy temp writes and snapshot bounds, confine website prerender reads, fix Sentry worker ownership, and remove shell interpolation from ranking evaluation. Preserve the existing release project-file boundary and add security regression coverage.