feat(artifacts): add strict BM25 publication

[fishmingyu]

Summary

Adds an isolated strict BM25 publication producer on top of #592. It plans exact canonical bytes from one retained source generation and replays them through strict workspace authority without changing the legacy SourceTrust or native-vector paths.

Changes

• Add PlannedBm25View plus strict plan, replay, and high-level normalization APIs.
• Bind source and output records, repository fingerprint, and caller configuration into one exact workspace subject.
• Enforce bounded UTF-8 JSON, duplicate/nonfinite rejection, exact output inventories, lexical and physical repository separation, and staged/published repository verification.
• Preserve first-primary iterator cleanup behavior and invoke provider support exactly once after caller inputs are frozen.
• Export the new API and record the remaining production-provider, context, and M2 profile work in the storage roadmap.
• Add adversarial coverage for overlap aliases, repository drift rollback, provider/request mismatches, forged plans, source drift, and BM25 query compatibility.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally
• Added new tests for the changes
• pytest -q test/artifacts/test_portable_views.py test/artifacts/test_strict_bm25_publication.py test/artifacts/test_context_artifact.py test/artifacts/test_runtime.py test/test_workspace_provider.py test/test_captured_directory.py test/test_atomic_directory.py test/test_bounded_json.py test/test_native_index_authorization.py test/test_source_fingerprint.py --tb=short — 628 passed, 15 skipped
• Black, isort, flake8, py_compile, and git diff --check
• Two independent read-only reviews: P0=0, P1=0

Checklist

• My code follows the project style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• Any dependent changes have been merged and published

Stack dependency: #592 is the explicit base. Keep this PR draft until that dependency is merged or the stack is restacked.