fix: recover expired AWS initial publication

[mellowcroc]

Summary

• add a narrowly scoped recovery path for an initial AWS publication interrupted by expired credentials in ceremonies frozen to Relay release 1828c720da11a3f9a83ba905a6c3352b6ca06615
• inspect and reconcile the exact retained publication attempt using create-only object semantics: accept matching objects, upload missing objects once, and reject conflicts
• keep ordinary coordinator publish from invoking recovery directly; use a container-only compatibility command with the frozen context mounted read-only
• after credential rotation and lock reacquisition, revalidate the complete frozen profile, runtime, storage target, workflow, and retained attempt
• make retries idempotent when remote publication succeeded but saving the local completion checkpoint returned an ambiguous result
• add an integrated frozen-1828 recovery test and synthetic compatibility fixtures

An independent adversarial design review led to the restricted entry point, post-rotation revalidation, and ambiguous-checkpoint reconciliation. This review is not a security certification.

Validation

• go test ./...
• go vet ./...
• bash scripts/test-install-launcher.sh
• git diff --check

Tessera compatibility

No setup contract, schema, ruleset, or downloaded-plan behavior changes. Existing selected and frozen ceremonies remain pinned to their original release. The required private Tessera integration run against exact head 47c06016fd73129e2572bebabbcb71d65adae2b8 is still pending.