fix(publish): sync publisher hardening + fail-closed institution-identity gate

[exos-marc]

What

Brings the party-anonymous playbook publish pipeline current and adds a final, deterministic institution-identity gate.

Publisher hardening (this branch was at the initial public-release state)

• publication-noise scrub (e-sign audit lines, emails, UUIDs, URLs, opaque tokens)
• street-address redaction, incl. City, <FullStateName> ZIP
• GC --redact-terms with match-across-punctuation
• dict-KEY rewriting and scanning (slugs live as corpus.stats map keys)
• version_ingest filename-stem → ordinal

New: step 5.5 — fail-closed institution-identity gate

After every transform, re-scan the whole surface — string values AND dict keys for high-confidence institution-name shapes (University of X, X University, X College, Regents of …, Board of Trustees/Regents) and any postal address surviving the scrub. Any hit raises PublishError, unconditionally (like the known-entity backstop); the fix path for a real survivor is --redact-terms.

This closes the class of leak where a counterparty that was never registered survives in a signature block, a corpus.stats dict key, or a filename-derived document_id slug — which the list-dependent known-entity backstop and the advisory proper-noun sweep both miss. Governing-law states ("laws of the State of New York") and generic descriptors ("the University", "College of Health Professions") deliberately do not match, so the gate is fail-closed without blocking benign content.

Verification

• Detector validated against real leaked-name strings (all caught) and a benign set (zero false positives).
• Regression tests: a name leaking across prose + dict key + slug hard-blocks; --redact-terms clears it on every surface; governing-law / generic descriptors pass; City, <FullState> ZIP redacted.
• tests/test_publish.py green (23/23).

🤖 Generated with Claude Code