* chore: release engine-v1.16.0 + dagster-v1.12.0 + vscode-v1.8.0

Bundles the governance waveplan — five merged PRs (#240 audit trail,
#241 classification + masking, #242 rocky compliance, #243 role-graph,
#244 retention) on top of three FR-004 / state-path follow-ups
(#237 error-path idempotency, #238 state-path unification,
#239 success-path idempotency finalize).

Version bumps: engine 1.15.0 → 1.16.0, dagster-rocky 1.11.0 → 1.12.0,
vscode extension 1.7.0 → 1.8.0.

CHANGELOGs updated for all three artifacts.

* chore(dagster): regen test fixtures for 1.16.0

Fixture drift flagged by CI (`codegen-drift.yml`). Fixtures are captured
from the live engine binary — the version-string bump to 1.16.0 ripples
through every `version` field, and the Wave A audit-trail work (#240)
adds the 8 `RunRecord` fields to `rocky history` output, which the
playground POC now emits.

Regenerated via `just regen-fixtures` against
`examples/playground/pocs/00-foundations/00-playground-default`.

* chore(scripts): sentinel top-level version field in fixture normaliser

Every CLI output's top-level `version` is `env!("CARGO_PKG_VERSION")`
at emit time, so every engine version bump rippled through all 38
captured fixtures — every release PR fought `codegen-drift.yml` until
`just regen-fixtures` was re-run.

Extend the existing `AUDIT_FIELD_SENTINELS` set (Wave A already
sentineled the audit-trail `rocky_version` field + hostname / git
commit / etc.) with the top-level `version` key → `"0.0.0-SENTINEL"`.
After this, version bumps only touch Cargo.toml / pyproject.toml /
package.json / CHANGELOGs — never fixtures.

Regen captured all 38 fixtures; top-level `version` now uniformly
renders as `"0.0.0-SENTINEL"`.

…ion actions (#251)

Closes the `--env <name>` plumbing gap left over from the 1.16.0 governance
waveplan: `RockyConfig::resolve_mask_for_env(Option<&str>)` already accepted
an env, but `rocky run` / `rocky plan` hard-coded `None`. This wires the flag
through on both commands so `[mask.<env>]` overrides resolve over the
workspace `[mask]` defaults, matching the `--env` shape `rocky compliance`
already uses.

`PlanOutput` gains three additive action-row collections — a dry-run view of
the control-plane governance work the post-DAG reconcile pass in `rocky run`
would do:

- `classification_actions`: `(model, column, tag)` triples from
  `[classification]` sidecars.
- `mask_actions`: `(model, column, tag, resolved_strategy)` where the tag
  resolves under the active env; unresolved tags are a `rocky compliance`
  diagnostic, not a preview row.
- `retention_actions`: models with `retention = "<N>[dy]"` sidecar, carrying
  the parsed `duration_days` + a warehouse-native `warehouse_preview`
  (Databricks renders the Delta TBLPROPERTIES pair; Snowflake renders
  `DATA_RETENTION_TIME_IN_DAYS`; other adapters emit `null`).

All three fields use `skip_serializing_if = "Vec::is_empty"` so existing JSON
consumers on projects without governance config are byte-stable. `PlanOutput.env`
carries the active `--env` under the same treatment.

Role-graph reconcile stays env-invariant. `rocky.toml` has no `[role.<env>]`
override shape (contrast `[mask.<env>]`); roles represent deployment-wide
permission groups while masks vary per env. `--env` therefore does NOT flow
into `reconcile_role_graph`. Classification tagging and retention policies
are also env-invariant by the same reasoning.

Regenerated bindings via `just codegen`:
- `schemas/plan.schema.json`
- `integrations/dagster/src/dagster_rocky/types_generated/plan_schema.py`
- `editors/vscode/src/types/generated/plan.ts`

Dagster `PlanResult` hand-written model picks up the four new fields
(`env`, `classification_actions`, `mask_actions`, `retention_actions`) and
re-exports `ClassificationAction` / `MaskAction` / `RetentionAction` from
the package barrel. New `PLAN_WITH_GOVERNANCE` scenario + `plan_with_governance_json`
fixture + `test_parse_plan_with_governance` parse-guard.

Follow-up of the governance waveplan shipped in engine-v1.16.0 (#241, #243, #244).