Keep release metadata and roadmap current

[blisspixel]

What changed

• Synchronize uv.lock with package version 0.19.45 and the current yt-dlp dependency floor.
• Add a blocking uv lock --check step to CI and pre-commit.
• Add metadata contracts that keep the editable root version and lock-freshness gates synchronized.
• Correct roadmap claims about pre-commit coverage, wheel size, and partially completed backlog items.
• Update contributor instructions for the lock freshness gate.

Why

The post-release README and roadmap audit found that the published 0.19.45 artifacts were correct, but the checked-in lockfile still described distillr 0.19.42 and an older yt-dlp floor. The root cause was that uv sync --frozen accepts stale editable-project metadata, so the existing CI flow did not detect version or dependency-specification drift.

Impact

There is no runtime, CLI, MCP, schema, provider, or corpus behavior change. The patch improves documentation accuracy and makes future release metadata drift fail locally and in CI.

Validation

• uv lock --check
• Commit and pre-push hooks
• uv run ruff check .
• uv run ruff format --check .
• 6,375 tests passed, 4 skipped, 8 live-network tests deselected
• 95.06 percent branch coverage
• Pyright: zero diagnostics
• Import contracts: 4 kept, 0 broken
• Bandit: no medium or high findings
• pip-audit: no known vulnerabilities
• Generated public contracts and Agent Skill distributions current
• Wheel build, required runtime assets, and isolated installed-bundle smoke passed