fix(publication): authenticate retired checkpoint reads

[rynfar]

Problem

The concurrent publication consumer tests exposed a cleanup interleaving where a retained or current checkpoint can be unlinked while another process has its bounded read pinned. Treating the changed root generically could either fail a valid epoch-2 handoff or let a weak successor shape reach projection repair.

Fix

Checkpoint reads now receive only context-authenticated digest anchors for the exact current checkpoint and its exact retained predecessor. A typed same-inode removal converges only after its description, path, digest, carried canonical bytes, epoch, and context role all match. The one stable-root proof then returns either byte-exact current authority or one fully bound immediate successor with the deterministic epoch ID, history, source authority, anchor, checkpoint paths, and epoch directory.

Repair, cleanup, rotation, and normal-operation callers consume that classified authority before effects. Mutation, inode replacement, unanchored unlink, ambiguous or malformed successors, competing final roots, and I/O failures remain terminal.

Verification

• Node syntax checks passed.
• Focused consumer-lock test passed repeatedly, including the retained/current checkpoint barriers and the 12-process rotation wave.
• Publication tests passed 33/33 twice consecutively.
• Release tests passed 10/10.
• GitHub App acceptance tests passed 6/6.
• npm run check passed across 964 files with no fixes.
• Two pinned offline packs produced the same five files byte for byte.
• git diff --check passed.

Review

The regression replaces a previously authenticated successor after its final root read with a stable canonical forged +1 checkpoint. It keeps the predecessor and retired-directory fields while changing the epoch ID, history, source authority, and anchor. The operation fails closed, and its projection, claim, terminal, transition, and applied records remain byte-exact.

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}