fix(publication): converge consumer lock helpers

[rynfar]

Problem

The first combined preview safely failed before approval. The follow-up audit found two exact same-rotation helper gaps:

• A commit helper that found an authenticated applied marker still republished immutable transition and applied temporaries under prior ownership.
• A rotator fenced during its early operation-frontier scan had not yet cached the exact old-epoch rotation intent needed to prove that the same rotation had completed.

No release, tag, or approval state was mutated.

Fix

• Treat an authenticated applied marker as a completion receipt only after validating its exact terminal transaction chain and final digest. Repair only the mutable projection when needed, revalidate it against the current immutable tip, and return without another transition or applied publication.
• Cache the exact expected rotation intent from the authenticated old checkpoint and effective immutable tip before the early frontier boundary. On the exact epoch fence, run one fail-closed completion proof and return only the matching epoch and tip receipt.
• Keep the later response-loss recovery paths and competing or malformed publication failures unchanged.

Deterministic coverage

• An already-applied claim rejects any redundant transition or applied afterFileSync publication while rotation still completes.
• Two rotators stop at their second scan-claims boundary. The winner completes first, then the resumed rotator returns the byte-identical epoch-2 receipt.
• Existing live prior-temporary and competing-publication negatives remain, along with the concurrent process stress wave.

Verification

• Publication contract: 33/33, twice consecutively
• Deterministic consumer-lock target: 1/1
• Release contract: 10/10
• GitHub App acceptance: 6/6
• npm run check: passed
• Pinned offline pack: two builds, all five outputs byte-identical
• Staged diff SHA-256 before commit: 79a1d71bb74e7e91a2ce33baf85410eb8d7dacea5d8f2de55975f6e6dae47085

Refs pylon-code/pylon#193

Model/harness: GPT-5.6 via Prime Agent

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}