[codex] Phase 3J: upstream deferral audit

[sukar0972]

Summary

• document Phase 3 completed PRs and Phase 3J as the audit-only gate before Phase 4
• explicitly defer desktop/Electron/WSL, browser simulation/preview automation, mobile/native, release-only, and dependency/tooling commits
• add reviewer heuristics/checklist for preventing incompatible upstream ports from leaking into web catch-up PRs

Grok Composer 2.5 review

• verdict: approve with suggestions
• incorporated Grok suggestions by clarifying Phase 3J as this audit, adding safe-to-port heuristics, reviewer rules, hybrid-commit guidance, and grep/check terms for browser/preview risk

Verification

• vp check

Notes

• Docs-only PR; no code/typecheck required by AGENTS.md.
• Existing unrelated react(no-unstable-nested-components) warnings remain during vp check.