v0.64.0 stable; v0.65.0-preview trust hardening

v0.64.0 propagates folder-trust state in headless mode and emits ACP usage_update notifications. Preview enforces read-only workspace settings in untrusted folders.