fix(ci): recover retained checkpoint publication

[vincentkoc]

What Problem This Solves

Fixes: an initial private checkpoint can remain unpublished after its assets upload and a later migration step fails.

User Impact

Operators can explicitly finalize the retained checkpoint after a successful read-only diagnostic and two complete verified restores. Original provenance and assets remain unchanged. This is a manual recovery operation; uncertain publication outcomes stop for inspection.

Why This Change Was Made

The existing migration owns checkpoint creation, so recovery reuses its exact retained draft and canonical restore validation. Finalization verifies the diagnostic's actual job, inputs and executed markers, then checks every part, database hash, SQLite integrity and table facts twice. It repeats source and custody admission before one publication request, with bounded work and no retry after an ambiguous response.

No schema, credential, collection, upload, cache deletion or scheduling change is included. Production Python grows by 182 lines and workflow code by 36 lines to enforce this recovery boundary; tests grow by 304 lines.

Evidence

• 61 focused Python tests pass, including both complete restore rounds, cleanup between rounds, corruption and identity drift, capacity/deadline/process failures, response-loss outcomes, and captured ANSI job-log admission.
• Three Go workflow/publication integration tests pass.
• Independent full-source and lifecycle reviews pass; the integrated acquisition and finalization functions match their separately reviewed versions.
• P0–P3 review found one hosted CLI compatibility issue, now fixed and covered by a fresh scoped-clean review.
• All 18 hosted checks pass on c80101b; CI run 39044023410 completed all 12 jobs successfully. Its merge tree matches the reviewed source exactly.
• The actual successful diagnostic log was checked for the bounded runtime input and executed-marker contract.
• The hosted GitHub CLI contract requires byte-preserving output for captured ANSI logs. That request alone uses the supported flag; local CLI live proof is unavailable because the installed local version predates it.
• Full production checkpoint finalization remains a separate reviewed operation after this source lands.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.