feat(kb): ship the provenance tool firewall switched ON - #461

chore: sync develop with main (#460, #461, #462, #463, #465, #466, #467)

…#470)

The roadmap table jumped from v8.26.0 straight to v8.32→v8.34, and the
changelog's newest entry was v8.30.0. Five versions had shipped without a
roadmap row and five without a changelog entry, so the two tables that answer
"what is in this product" disagreed with each other and with the code.

Backfilled from verifiable sources rather than reconstructed from memory:
merge dates come from the merge commits (#397 2026-07-10, #402 2026-08-24,
#403/#404 2026-08-06, #424 2026-08-30, #443/#448/#452 2026-08-29,
#455/#461 2026-08-30), and the substance from the ADRs that accompanied each
cycle plus the CLAUDE.md sections written when the work landed. Where a
changelog entry already existed (v8.27, v8.28, v8.30) the roadmap row
summarises that entry rather than re-deriving the history.

Roadmap gains v8.27.0, v8.28.0, v8.29.0, v8.30.0, v8.31.0 and v8.35.0, so the
table now runs unbroken from v8.25 to the present. Changelog gains v8.29.0,
v8.31.0, v8.32.0, v8.33.0, v8.34.0 and v8.35.0.

v8.27.0 also stops claiming to be "in progress": PR #424 merged on 2026-08-30
and completed it, so the heading was three weeks stale and would have told a
prospective consumer the API connector was unfinished.

v8.35.0 is this cycle — laravel/ai 0.8→0.11 and laravel-flow 1.1→2.5 landing
together, the flow surface closing its R32/R44/R45 gaps, and the empty-tenant
fix that came out of review. The entry keeps the parts that are load-bearing
for anyone upgrading: that the tenant on converted history was the real risk
and why a `default` stamp there would have been undetectable, that four of the
v2 breakages fail at boot rather than gradually, and that the first R32 test
was theatre because routes register at boot from a flag the test flipped too
late.

R45 parity verified rather than assumed: every version documented here already
has its deep doc-site page — connectors-api, team-management,
case-study-email-datasets, system-administration, source-permissions,
ingest-provenance, tool-firewall and flow-orchestration all exist. The
doc-site was never what fell behind; the README was.