docs(media): record image activation and paid production proof

[halfaipg]

Records the approved image-only rollout on unchanged Core ca1f2a1 / Alembic 0042: real isolated billing/GPU/R2 qualification, fault/refund and disconnect proofs, 61 PostgreSQL regressions, drained configuration-only activation, six paid public API canaries, exact receipts and rollback. Charging and payout/validator policy unchanged. Gallery PR 39 is deployed. Timeline/3D and the locked signed-in browser check remain explicitly separate. Docs only; diff-check passed.

[halfaipg]

Final verification: all six production Core processes explicitly have charging on and both image paths admitted. Read-only SQL independently reconciled all six production receipts: 90,000 micro-USD actual = 80,000 purchased + 10,000 daily, one terminal and completion each. The temporary key is revoked. Scratch services, both databases, role and plaintext test credentials were removed after preserving private evidence and a database dump. Production remains healthy with six workers; no payout or validator policy changed.

[halfaipg]

Additional Gallery-only hardening: the compiled artifact scan (separate from source reachability) flagged linked grpc GO-2026-6443. Gallery does not configure the advisory-required xDS server path. PR 41 nevertheless updates grpc to 1.83.2 and required x/net 0.58.0, adds a binary CI gate, and passed all checks; fresh restored-backup proof is green. No Core, billing, recipe or worker changes accompany that follow-up.