docs(codeapi): record the STG cold-start rollout and acceptance

[rschlaefli]

Summary

Records the STG rollout of the cold-start retry correction and its end-to-end acceptance in the governing plan's Progress section, with a new dated section under the approval summary.

Recorded evidence

• PR fix(sandbox): wait for refused connections within the job deadline #32 merged as f6ec42cd44729b33a950016114651ca28fdcd172 (merge commit, both prior fork baseline and upstream v1.4.0 retained as ancestors; no fork tag or release).
• Image build 35516095220 passed all seven jobs; all seven merge-SHA tags resolve in the registry.
• helm-charts !112 merged at 95c8cf1bf550730fe82bc90bf0fdf4bfff95a32f (seven STG values pins) and df-cloud !602 advanced CODE_INTERPRETER_TARGET_REVISION; the chart itself is byte-identical to 5d063ffe.
• ArgoCD app-codeapi synced from values revision 95c8cf1 at 2026-09-20T15:03:05Z, Synced/Healthy; all five service deployments run the merge-SHA images and KEDA retains sandbox-runner scale ownership.
• Authenticated probe: cold execution HTTP 200 after 271,103 ms (previous failure: 502 after 134,816 ms), warm 294 ms, exact download bytes, bounded timeout as sandbox_time_limit (exit 137, SIGKILL), cancellation returning cancellation_requested → cancelled with no late artifact across the 360-second retention window, and deletion verified absent.
• Storage health unchanged: fifteen free volume slots, one writable volume per required collection, both canaries completing.

Receipts live in the gitignored docs/project/_local/reviews/ area (2026-09-20-stg-coldfix-rollout.json, -e2e.json, -cancellation.json).

Limits

This acceptance covers the CodeAPI surface. No STG LibreChat instance routes to the internal service, so LibreChat integration stays an open consumer gap. PRD promotion remains gated on its alert-destination decision, its own recovery evidence, and separate storage and application promotions; no PRD change is included.