vellum-feature-flag-rollout

# Vellum Feature Flag Rollout ## Flag Rules Assistant feature flags use simple kebab-case keys and must be declared in: ```text meta/feature-flags/feature-flag-registry.json ``` New flags require: - `scope: "assistant"` - a canonical kebab-case key - a safe default - tests or guard coverage when resolver behavior changes - a companion `vellum-assistant-platform` PR to provision the flag in Terraform ## Rollout Hygiene Do not ship user-facing release notes for default-disabled or rollout-only features. `UPDATES.md` processing does not check feature flags, so flagged copy can leak into user-facing prompts. When a feature later reaches GA, add a new append-only release-note migration. Do not mutate an old no-op migration into a release-note migration. ## Permission Controls V2 Under `permission-controls-v2`, do not add new deterministic approval modes for assistant-owned actions beyond the conversation-scoped host computer access gate. Avoid global toggles, persistent trust-rule UI, wildcard scopes, and time-window approvals. ## Review Workflow 1. Confirm whether the change adds, renames, removes, or consumes a flag. 2. Check registry declaration and key format. 3. Check default behavior and rollout safety. 4. Check docs, release notes, and user-facing copy for flag leaks. 5. Check whether the platform repo needs a Terraform update. 6. Recommend focused tests for resolver, route, UI, or behavior changes. ## PR Notes Call out: - flag key - default state - rollout p...