fix: per-crate README audit + VERSION no longer drifts (26.6.26)

[ancongui]

What

A correctness release (26.6.26). An audit of all 74 per-crate READMEs against each crate's real public API turned up 43 doc fixes and surfaced a genuine framework bug.

1. VERSION no longer drifts (framework bug — also repairs main)

Every crate's pub const VERSION was a hardcoded "26.6.24" literal that nothing kept in sync with the workspace version. So firefly_kernel::VERSION, the actuator /actuator/version payload, and the startup banner all reported a stale release number, and the version_matches_crate_version guard tests only passed while the workspace happened to sit at 26.6.24.

⚠️ This means 26.6.25 (PR #27) actually shipped with these guard tests red — that CI run passed because it executed before the version bump, and the post-bump merge only re-ran fmt-check. This PR makes main green again.

Fix: all 52 hardcoded constants now derive from env!("CARGO_PKG_VERSION") (the re-exporting crates already chained to firefly_kernel::VERSION). The cli FRAMEWORK_VERSION const and the six unit/integration tests that asserted VERSION == "26.6.24" against a frozen literal were de-hardcoded the same way. VERSION can never drift again.

(The cli render_for / SBOM-parser fixtures keep their literal sample versions — that string is arbitrary test data exercising the render/parse logic, not the build version.)

2. Per-crate README audit — 43 confirmed fixes across 28 crates

Each finding was verified against the source before applying:

• Phantom / incomplete public surface: admin AdminDeps.environment; openapi RouteDef (4 fields), Parameter::{query,header}, Builder::{add_schema, add_schema_descriptors, from_inventory, docs_router}, DocsConfig; orchestration CompensationPolicy (all 6 variants) + SagaError; starter-web WebStack::{set_security, set_exception_advice}; testkit BuiltSlice::web_client; idp Error + change_password; security/webhooks/kernel/transactional/plugins.
• Wrong signatures / variants: notifications-* EmailStatus::SENT/FAILED → Sent/Failed (the #[serde(rename)] only affects the wire form); plugins Vec<Arc<dyn Any>> → the real Extension = Arc<dyn Any + Send + Sync>.
• Wrong facts: admin bean graph does ship dependency edges (not "nodes-only"); backoffice middleware order includes TraceContext; container warm→form typo; resilience/starter-core/eda-kafka/session-*.
• Stale version pins: README dependency examples pinned the long-stale 26.6.7 → now the self-maintaining minor pin version = "26.6".

3. firefly-cache doc comment

The audit flagged the cache README for referencing firefly-cache-redis as if it didn't exist yet. The README was right — firefly-cache-redis (RedisAdapter) is a shipped, published member. The actually-stale thing was the cache/src/lib.rs comment ("once the Redis adapter ships in the next minor"); fixed the real source of truth instead. (Caught as a false positive during verification.)

Verification

make ci green end-to-end: 315 suites, 4484 tests, 0 failed — including every version_matches_* / version_is_stamped guard, which now hold for every release rather than only at 26.6.24.

Follows #26 (README + first chapters) and #27 (full book audit).