GET /api/v1/releases answers the kept releases, and ?shipped=true what went live, as MCP `releases` does #8020

Intent: any harness can ask "what is live and what is on its way" over HTTP; today only MCP releases (src/http/mcp/tools/releases.ts), /releases and /changelog answer it.

Done looks like:

• [ ] The tool's two answers move into one module, src/release/answer.ts: shippedAnswer(app) ({ version, commit, live, onItsWay } from readLandings) and releasesAnswer(app, user) (the items list, or a refusal when mayRead says no). The MCP tool calls them and answers exactly as today.
• [ ] A new src/http/api/releases.ts registers GET /api/v1/releases: ?shipped=true answers shippedAnswer for anyone; without it, releasesAnswer for whoever may read /releases, else 403 forbidden with "the release history is for the forge's administrators and its repository's readers". Any other shipped value is 422 invalid_shipped.
• [ ] src/http/api.ts: the import goes directly after the forgeRoutes import and the call directly after forgeRoutes(router); (other issues register elsewhere).
• [ ] src/contract/openapi/routes/getApiV1Releases.ts describes it (auth false, the query, both refusals), exported from src/contract/openapi/routes/index.ts in its alphabetical place.
• [ ] A new test/api-releases.test.ts proves: ?shipped=true answers 200 with no token; the list answers an admin the rows MCP releases gives and a stranger 403; ?shipped=maybe is 422; the route is in the OpenAPI document. It fails without the change.
• [ ] bun test test/api-releases.test.ts test/mcp-size.test.ts passes.

Files: src/release/answer.ts, src/http/mcp/tools/releases.ts, src/http/api/releases.ts, src/http/api.ts, src/contract/openapi/routes/getApiV1Releases.ts, src/contract/openapi/routes/index.ts, test/api-releases.test.ts Risks: read-only; rollback stays a person's act on the page. Brief: a builder who knows the API.