feat(authoring): consolidate input provenance and paired staging

[777genius]

Adds paired npm pack response validation, frozen-input provenance, paired staging contracts/readers, and isolated workflow routes. Each product is packed once; retained bytes are validated without repacking. Legacy publishing routes remain isolated.

Stacked on #219. Refs #223, #225, #227, #228, #208. Owner-requested consolidation of independently reviewed checkpoints; combined delta is 3,924 changed lines (3,867 additions, 57 deletions), an explicit consolidation exception to the usual review budget.

Independent source reviews accepted the constituent checkpoints. All 10 required CI checks passed at 221fccb. Its Git tree is identical to reviewed 0d50e5b (39cb72fb825b64f551391813d9472e63a6204518).

This merge consolidates the parent feature branch. Accepted N2, genuine authenticated custody, protected execution, full public/platform E2E and release qualification remain open. No main activation or release publication.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}