fix(release-script): regenerate the knowledge surfaces with every version bump

[DemchaAV]

Why

The knowledge surfaces embed the reactor version — extract-api reads it from the
root pom.xml — so every version bump cut-release.ps1 performs makes them stale
in the very commit that ships the bump. Neither bump noticed:

• A release cut commits and tags a pack still naming the -SNAPSHOT. The
  tag-time gate in release.yml runs
  extract-api --from-reactor --check (line 62), so the cut fails after the tag
  is already pushed.
• The -PostReleaseOnly bump commits a pack still naming the release, which
  leaves develop's "Knowledge pack — API surface is current" job red until a
  follow-up commit regenerates it.

Both happened. 2d5694ae and 61d38ffc are those follow-up commits — one per
cycle, the second landing the day after the bump it was chasing
(4684295c).

What changed

• Update-KnowledgeSurfaces runs extract-api --from-reactor plus
  check-claims --check and check-routes — the same three commands the tag-time
  gate runs, because the pack ships as one unit and a claim naming API no surface
  has would ride the commit unchallenged.
• It is called between the bump and its commit in both modes: Step 5c on a
  release cut, Step 3c under -PostReleaseOnly. Both commits stage knowledge/,
  so the regenerated surfaces ride with the bump they track rather than becoming
  the next follow-up commit.
• Deliberately not skipped by -SkipVerify: the surfaces must move with the
  version either way, and Step 4 already installs every module the extractor reads
  (core plus render-pdf, render-docx, render-pptx, templates, testing).
• A pre-bump probe (Step 2b, extract-api --from-reactor --check) refuses
  -PostReleaseOnly before any pom moves when the tree cannot regenerate the
  surfaces. Without it Step 3c would be the first to notice missing classes, with
  13 poms already rewritten and the clean-tree preflight blocking the retry.
• A missing node skips the regen with a loud red warning naming the command to
  run, rather than throwing — a cut on a machine without Node is still a valid cut,
  but the operator has to know the commit ships stale surfaces.
• ReleaseAssetStepGuardTest gains two cases, one per path, in the shape of the
  previews guard one step over: the regen step exists, the staging exists, and the
  regen comes first. The two halves live in different parts of the script and
  neither fails without the other.

Verification

./mvnw -B -ntp clean verify -pl :graph-compose-core,:graph-compose-render-pdf,:graph-compose-render-docx,:graph-compose-render-pptx,:graph-compose-templates,:graph-compose-testing,:graph-compose-qa,:graph-compose-coverage -am
→ BUILD SUCCESS, 10 modules, 4m02s. ReleaseAssetStepGuardTest 6 tests, 0
failures (4 existing + 2 new).

The new guard is proven fail-closed, not assumed: with Step "5c" removed the
suite goes red on theCutRegeneratesTheKnowledgeSurfacesBeforeStagingThem, and
green again once restored.

The step's own commands were run against the built tree — extract-api --from-reactor, check-claims --check, check-routes all exit 0, and the regen
produces no diff, confirming it is idempotent on a current tree and that
provenance lands in target/knowledge/ rather than in the staged directory.

$repoRoot is script-scope and Update-KnowledgeSurfaces is declared before both
call sites; $bumpedPoms and $nextSnapshot are assigned before the steps that
read them. Every git mutation the script performs stays inside its existing
if ($DryRun) guard.

Notes

• Staging knowledge/ as a directory rather than an explicit file list is a
  deliberate exception to the repo's staging rule: Step 0 requires a clean tree, so
  the only changes under it are the ones the regen just wrote, and the add stages
  nothing when the regen was skipped.
• No CHANGELOG entry — release tooling is not a consumer-visible surface, matching
  b1a3c618, the last fix(release-script) cut, which took none.
• The docs line the change had to touch also corrects "seven per-module READMEs" to
  "eight"; the list beside it already named eight.

Lane: build/CI + docs — cut-release.ps1, its guard test and
docs/contributing/release-process.md; no library code is touched.