fix: recover unpublished checkpoints without collecting again

[vincentkoc]

What Problem This Solves

Checkpoint saves can outlive their step budget, leaving retained state unpublished even after native ingestion succeeded.

User Impact

Saves now use one shared deadline with safe phase timings. A reviewed manual recovery can verify an existing publisher checkpoint twice and publish its private archive without collecting or uploading the state again.

Why This Change Was Made

The save owner removes one redundant intermediate integrity pass while preserving pinned source facts and authenticated full-state readback. Recovery requires the original native-success/checkpoint-failure/archive-skipped evidence, a successful diagnostic, unchanged parent custody, and an archive containing no external media or embedding payloads.

Offline native export runs before any promotion. Its original producer identity is preserved, recovery provenance is recorded separately, and the verified direct-child commit is published once with an exact-parent lease. Uncertain outcomes hold without retry.

Runtime/workflow LOC: +448/-75 (net +373); tests: +522/-5. The added owner boundary is explicit retained-publisher admission and publication; no schema, collection, cloud, or scheduler change.

Evidence

• Focused save tests cover the reduced integrity-pass count, real corrupted-backup rejection, shared deadlines, and uncertain mutation outcomes.
• Fifteen recovery/process tests cover parent drift, media holds, two full restores, lost promotion responses, bounded output, and real Git lease success, concurrent updates, and lost push responses.
• Native publication replay and workflow contract tests pass.
• Exact-head full Python suite: 85 tests passed. Both independent source reviews approved the final head, including explicit retained-state holds for post-promotion failures. Fresh exact-head P3 completed scoped-clean. All 19 hosted checks passed, including CI run 39049404209, Docker, CodeQL, and secret scanning; the checked merge tree exactly matches the reviewed tree.
• Production recovery and the remaining checkpoint duration are unverified; this draft does not activate a workflow.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.