Self-serve promotion of a claimed stub org to tracked

Signed-in only, and the caller must hold a verified claim on the resolved org (403 otherwise). Materializes stored release locators into sources — tier-1 (feed/github/appstore) go live, tier-2 (bare url/file) land paused for curator review — and flips the org to tracked. Idempotent: an already-tracked org is a no-op success. Gated behind a dedicated kill switch (creates live fetching sources).