Prepare 0.22.0 release

[zackbart]

Summary

• release principal-scoped connector visibility and shared/personal downstream auth as 0.22.0
• align package, runtime, template, and upgrade-guide versions
• turn the Unreleased notes into the dated minor-release narrative
• record the reviewed Cloudflare Worker script deletion contract after the published spec removed a spurious required empty body (Reconcile Worker script deletion contract drift #517)

Compatibility

• existing connectors remain shared and identity rules remain opt-in
• in-flight get_result ids created by a named caller do not cross into the new subject partition; finish paging before deployment
• single-user deployments need no identity configuration
• non-Worker deployments can ignore the Managed OAuth callback-policy addition

Verification

• npm run drift:check -- --specs
  • Cloudflare: no drift across 49 reviewed endpoints
  • Notion: no drift across 14 reviewed endpoints
• npm run release:check
  • 118 test files, 2,796 passing tests, 40 skipped
  • docs, generated UI, lint, unused exports, typecheck, build, examples, audit, and package smoke passed
  • Docker package smoke skipped because Docker is unavailable

Maintainer note

The hosted-catalog half of npm run drift:check could not run locally because CONNECTA_DRIFT_LINEAR_KEY, CONNECTA_DRIFT_STRIPE_KEY, CONNECTA_DRIFT_MIXPANEL_KEY, and CONNECTA_DRIFT_REVENUECAT_KEY are not exported. Do not tag until that gate is run or explicitly waived.