chore(release): prepare v0.28.0

[tcballard]

Outcome

Prepare AsDecided v0.28.0 as the release of the bounded graph-boost gate and named-target retrieval diagnostics delivered in #449.

Changes

• align the Rust workspace, decided, decided-mcp, lockfile, and MCP Registry manifest on v0.28.0
• pin the public container quickstart to the v0.28.0 CLI image
• add the v0.28.0 changelog entry
• explain that graph popularity can only affect lexical near-ties
• document decided diagnose as the way to inspect why a named decision did or did not surface

User impact

Relationship popularity can no longer promote a weak lexical match above a substantially stronger one. Authors can also run decided diagnose to see whether a target failed matching, was filtered, ranked lower, or fell outside the result budget.

Deliberate exclusions

• This PR does not create the v0.28.0 tag or GitHub Release. Publication remains a separate approval after merge.
• Benchmark PR asdecided/benchmarks#29 remains pinned to older released binaries until v0.28.0 artifacts and checksums exist.
• THIRD-PARTY-NOTICES is unchanged because the locked dependency graph did not change. The release workflow regenerates and packages it at the tag.

Validation

• ./scripts/verify-release-changelog.sh v0.28.0
• workspace, lockfile, dependency pins, Registry version, and OCI identifier alignment
• decided validate decisions/ — 451 valid artifacts, 0 invalid
• decided relationships decisions/ --validate — 2,694 relationships, 0 issues
• JSON validation for server.json
• git diff --check

GitHub Actions is green. PR Checks run #503 passed the release changelog, Registry metadata, dogfood, public-documentation, and package gates. Rust workflow run #176 passed the release workspace tests, strict Clippy, dependency policy, live-corpus invariants, and macOS and Windows runtime smokes.

After merge

Publish the GitHub Release tagged v0.28.0. The release event then runs the full native battery and publishes the native archives, SHA256SUMS, attestations, SBOM, signed container images, crates.io packages, and MCP Registry record. Once those assets exist, update benchmark PR #29 with the v0.28.0 checksums and workflow pins.