fix(publication): authenticate stable checkpoint retirement

[rynfar]

Problem

PR #50's hosted Pack A/B review exposed two final stable-proof gaps: checkpoint hardlink retirement can cross the last 2 -> 1 or 1 -> 0 boundary during the proof, and the provisional current checkpoint can disappear or reappear while the journal root is scanned.

Fix

• authenticate retirement with the exact checkpoint SHA-256 plus frozen, exact-key stat evidence for dev, ino, size, mtimeMs, ctimeMs, and nlink
• accept only one monotone 2 -> 1 or 1 -> 0 transition on the same inode and bind the final stable proof to the immediate successor
• close the proof namespace across initial, proof, and final directory reads, including removed/reappeared checkpoints and required epoch/temporary directories
• make provisional-current scan gaps fail unless the disappearance is authenticated, and keep generic read/stat failures terminal rather than treating them as retirement evidence

Verification

The reviewed evidence before finalization was clean:

• 144 child-process rotation cases
• focused and full publication tests
• parallel suite, release x10, App x6, and check
• two independent code reviews

Built with OpenAI Codex GPT-5.6 using Prime Agent.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}