feat(authoring): integrate paired staging and provenance workflows

[777genius]

Adds paired public npm staging and retained-stage reading, together with the provenance and stage workflow routes that invoke them. Each product is packed once; the completed reader validates retained bytes without repacking. A separate current-run validator supports isolated stage signing after the producer succeeds, while completed-stage admission still requires all three signatures. CLI transport and explicit mode/permission guards keep legacy publication separate.

Stacked on #225 at d7a08b7. Refs #228, #223 and #208. 10 files, 2,471 changed lines (2,427 additions, 44 deletions). Consolidates the independently reviewed #228 checkpoint into this PR at the owner's request to reduce the open stack; this exceeds the normal per-PR review target because it retains two already-reviewed checkpoints without rewriting history.

Validation: stage checkpoint 4ef512f received independent ACCEPT with 56 selected tests and all 10 required CI checks passed. Workflow checkpoint 0d50e5b received independent ACCEPT with 112 Node and 11 Go tests and all 10 required CI checks passed. Merge head 432819d has the identical Git tree to reviewed 0d50e5b, verified through GitHub's commit objects. Its fresh CI is running; no additional source change or new independent review is claimed for the merge commit.

This remains source integration. N2 acceptance, supported checked-artifact kinds, genuine provider/action mapping and tool/signature custody, protected execution, public E2E and release qualification remain open. Mocked tests and green CI do not replace those gates. No main-branch activation or publication is performed by this consolidation.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}