chore: sync dev to main for v1.0.39 #517

Why

dev has received the leftover-hardening delivery (PR #516, issues #512-#515) and carries everything on main. The release-fork from main mechanically derives v1.0.39 (latest tag graphagent-v1.0.38) and requires the series file .github/releases/v1.0.39.md with exactly that name on main, or the release job fails closed. This delivery syncs dev to main (the #492 pattern) and carries the v1.0.39 notes.

Scope

• .github/releases/v1.0.39.md (new file on this branch).
• The dev -> main merge itself (carrying test: make the memory stall timing assertion load-tolerant #512-refactor: converge the process-group kill primitive into util/process #515 fixes already accepted on dev).

Approach

• Draft notes from .github/RELEASE_NOTES_TEMPLATE.md: section order, codepoint-identical emoji headings, ASCII-only body, required Test Summary (fenced block) and Verification sections, final-line changelog link with {previous_tag}/{current_tag} placeholders.
• Fill from the test: make the memory stall timing assertion load-tolerant #512-refactor: converge the process-group kill primitive into util/process #515 delivery evidence; verify with a local render: release-notes.ts --version 1.0.39 --previous-tag graphagent-v1.0.38 --tag graphagent-v1.0.39.

Acceptance

• Local render exits 0.
• PR gates green (Typecheck, Unit Tests, E2E linux+windows, SpecGit Acceptance); specgit finish exits 0.
• After merge, release-fork from main produces graphagent-v1.0.39 marked Latest.