ci: wire disabled single-file theme draft publisher

[Pigbibi]

Source-only scope

Wire one repository-local publication path for data/output/theme_momentum_snapshot.json, with production still disabled.

• publish_draft_pr defaults to false; schedule remains artifact-only
• Source policy PUBLICATION_CONTENT_APPROVED = False cannot be overridden by CLI/environment. An explicit flag alone does not grant content rights. Admission rejects before collection, install, generation or production mint
• Remove direct commits/pushes to main and GH013 success fallback. Legacy commit_outputs is deprecated and ignored
• The candidate JSON and canonical receipt are bound to original bytes, source/base SHA, config bytes, run/attempt and exact same-run artifact ID/digest
• Isolated publisher job uses pinned official actions, contents-read GITHUB_TOKEN, and no Actions/cross-run permission. App token scope remains this repository with Contents/PR write, default post revocation
• Strict v2 shape, research-only policy, time, numeric ranges and configured theme/symbol scope checks reuse existing helpers; null/partial research data remains valid
• Run-bound immutable branch, full leaf-tree comparison, package/head markers, draft-only PRs, exact-base checks before and after writes; no force, main ref writes, merge or bypass
• Definite 401/403 and local validation failures retain exact sanitized reasons. Only transport/5xx and bounded branch-specific already-exists conflicts permit one read-only reconciliation, never repeat writes
• Failed package preparation/upload preserves successfully generated candidate bytes as an artifact while the job remains failed and published=false

Bounded files

Seven source/doc files only: workflow, new single-JSON helper and tests, existing workflow tests, both existing READMEs, and the first architecture paragraph's same-repository exception. The rest of architecture (including AI pair validation), all data/config, existing math/AI validators and required CI are unchanged. PETR is unchanged.

Verification

• Full suite with socket network access disabled: 452 passed
• Focused helper: 217 passed; workflow/identity: 98 passed
• Diagnostic regression RED: 18 failed / 199 passed before fix; GREEN: 217 passed
• Real builder default-now preserved .123456Z between same-second .123455Z start and .123457Z completion, so no time-floor relaxation was added
• YAML and every shell block parse; whitespace check passed
• Parent independently repeated the full offline suite and reviewed helper/workflow paths
• Base: cdc24c6; exact seven-file, one-commit diff

No new real collection, model/provider request, token mint, workflow dispatch or data PR was performed in this phase. Content/provider publication rights and explicit runtime approval remain separate prerequisites. This PR must not be described as production publication recovery. Keep draft for final review.