feat(artifacts): add strict context publication

[fishmingyu]

Summary

Adds strict, authority-bound whole-context publication on current main. The PR assembles retained portable BM25 and vector generations without reopening ambient paths or activating native vector indexes.

The strict path remains provider-neutral and is not connected to a production compiler, catalog, or runtime route. Related to #199; this slice does not complete M1 or M2.

Changes

• Add content-bound portable-view validation using retained publication and repository-source authorities.
• Capture one detached authenticated source identity per validation or strict context operation, and use it throughout planning, replay, and publication.
• Stream and canonically validate large document stores without whole-file DOM or byte caching.
• Keep vector native indexes inert and remove ambient filesystem influence from artifact model policy.
• Add deterministic strict context planning, replay, staging, and durable publication.
• Bind exact manifests, fingerprints, retained source records, output inventories, and staged/published validation.
• Record the strict whole-context publication boundary and remaining adapters in the storage roadmap.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally
• Added new tests for the changes
• Direct changed-surface matrix: 214 passed.
• Extended artifact/runtime/model-policy matrix: 333 passed.
• Local unit tier: 5,549 passed, 71 skipped, 191 deselected; the one additional deselection beyond the configured marker set is the installed-distribution metadata check because this shared environment still has CodeNib 0.2.0 while the checkout is 0.2.1. Clean GitHub installs cover that check.
• Project pre-commit hooks, git diff --check, and python -m mkdocs build --strict passed.
• The feat(artifacts): add strict BM25 publication #602 dependency and its post-merge Full CI, Docs, Release, and publish smoke are green on main.

Checklist

• My code follows the project style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• Any dependent changes have been merged and published