Stop upgrade-search from queuing mid-confidence matches that approve
cannot honor (owned movies/episodes 409'd on the TUI). De-dupe pending
review rows, scope 1080p gates to the target episode, refuse unsafe
pack cleanup, and require a token for non-loopback binds.
State that breadarr is bakery-distributed (not in the BOS ISO, not a GTK
desktop-shell app, no bread events), add CONTRIBUTING.md for the
single-trunk + RC-tag model, ignore leftover src.tar.xz artifacts, and
delete breadarrd/src/src.tar.xz.
