feat(storage): bind strict publication producers

[fishmingyu]

Summary

Restack the strict publication producer work onto the focused workspace authority in #619 and the source, vector, and atomic-cleanup foundations already merged to main.

This replacement removes the obsolete stacked history while preserving the producer contracts, authenticated repository reads, and static export hardening.

Changes

• bound publishable JSON and metadata before DOM allocation
• add the callback-scoped strict workspace provider contract
• migrate static Wiki export to retained source authority and authenticated staged/published validation
• route summaries, citations, graph excerpts, and codemap reads through the bounded repository-source reader
• compare static-export manifests against a verified detached identity rather than mutable public projections
• preserve first-failure and cancellation semantics across stage and source cleanup
• document the strict producer boundary and remaining provider integration work

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally

• Added new tests for the changes

• focused producer/export suite: 734 passed, 15 skipped

• full unit tier under the CI umask 022: 5,297 passed, 71 skipped, 190 deselected

• changed-range and final-fix pre-commit hooks

• python -m compileall -q codenib

• git diff --check agent/pr590-workspace...HEAD

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• My changes generate no new warnings
• Any dependent changes have been merged and published

Stacked on #619. Supersedes #591; it remains Draft until #619 lands and this branch is rebased onto main.