RustBox 0.2.1 - final source validation

Completed in this environment:
- offline release validator: scripts/validate-release-static.py (144/144 checks passed)
- all maintained TOML examples parse successfully
- Docker Compose topology/config references are validated by the offline release validator
- JSON files parse successfully
- browser JavaScript assembled in src/web/js/manifest.txt order passes node --check
- shell scripts pass bash -n
- Python helper scripts compile successfully
- Rust source delimiter sanity check passes after removing partial-patch leftovers
- git diff --check passes on the final source tree
- no Cargo.lock, *.orig, *.rej, temporary FIX/APPLY scripts, or patch leftovers are shipped
- regression source checks retain the 0.2.0 release gate and add 0.2.1 policy/backpressure checks

0.2.1 fixes included:
- OpenPGP policy visibility follows pgp_enabled and disabled OpenPGP is hidden from the UI
- OpenSearch 429/flood-stage failures trigger worker backoff instead of per-event warning storms
- Docker development defaults session cookies for direct HTTP and documents the production HTTPS requirement
- cluster_mode controls the implicit data_dir default; PostgreSQL/MySQL remain valid with local data_dir backends in single-node deployments
- storage/search configuration comes only from [storage] and [search]
- removed pre-0.2 top-level storage/search switches and the tantivy backend alias
- removed runtime legacy attachment read-through; attachment access uses logical BlobStorage keys
- fixed search_outbox tenant/import table parity
- fixed nested SQLite transactions in message move paths
- fixed the Clippy -D warnings failures reported for examples, config, storage, search, routes, realtime and formatting
- scripts/build-release.sh removes stale Cargo.lock, runs the static gate, generates a fresh lockfile for locked Cargo commands, and cleans it on exit

Not executed in this packaging environment:
- cargo fmt/test/clippy/build with Rust 1.88, because Rust/Cargo is not installed here and outbound DNS is unavailable
- live PostgreSQL/MySQL/S3/NFS/OpenSearch integration tests

The final release gate on a Rust host is:
  bash scripts/build-release.sh

This file intentionally does not claim blocked runtime/integration checks as passed.