feat(ci): add a release-read-only desktop publication probe

[loopx-agent]

Desktop compilation can finish while the separate Ubuntu publisher waits for a runner. This proposal adds a default-off, read-only publication_probe to verify the complete asset set on an admitted Windows builder. It disables the ordinary publisher in probe mode, never writes Release assets and grants no publication authority.

The existing CRLF identity and test-interpreter repairs are retained. The current head integrates main 60d833b1, including the merged canonical fixtures, qualification invariant repairs, timing reader and PowerShell single-command selection. All five original proposal files and the canonical Python asset owner remain byte-identical; this update reuses those repairs instead of adding another owner.

• Activation: reviewed workflow ref, existing public tag, explicit publication_probe=true. Omit it or set false to restore the ordinary publisher; operation and rollback are documented in docs/product/release-readiness.md.
• Contract: immutable tooling/product/run/attempt lineage, successful Mac peer without polling, bounded setup/budget observation, verified four assets/checksums/attestations and unchanged Release inventory. publicationAuthorized remains false; final Windows post-actions are separate evidence. Permissions, signing, 30-minute builders, 10-minute publisher and manifest-last recovery remain unchanged.
• Current source validation: nine real-owner semantic groups cover LF/CRLF, missing/extra/stale subjects, signature/API/page/attempt/budget refusal; five interpreter tests and two actual CLI default-off denials pass. Whole parsed workflow feature-off parity, strict TS/Ruff/syntax/semantic/DCO/public boundaries, four direct and all19 risk checks pass. Pre-record canary aggregate exit1 is stale receipt policy alone; the new exact-scope CQR remains failed for unqualified hosted outcomes.
• Historical failure readback: full Python run38249718307@fa3 ended cancelled, with27 jobs, three cancelled shards and shard3 completing with4 failures/5279 passed/85 skipped. Current matching immutable source evidence covers scheduler compatibility and Todo-less settlement. Goal configuration and native-launcher modules first pass31/skip13 where PowerShell is missing; adding verified official portable PowerShell7.6.6 yields 44 passed/0 skipped, including single/multiple Node paths. This executes on macOS, not hosted Windows. Original failure and skipped reports remain retained.
• Current hosted desktop qualification: automatic run38348478463, attempt1, completed successfully. Full Windows job115135248744 and macOS job115135248865 each passed the nine real-owner preflight cases, unsigned preview build, artifact upload and post-actions. Both tested merge 9c3cb7c9 (head 2b85633f into main 60d833b1); its tree exactly matches this PR head. The two preview artifact digests match the upload logs. Probe capture/attestation/verification and Release publisher were skipped.
• Current native Windows qualification: job115141960996, attempt1, completed successfully on the same head-equivalent merge 9c3cb7c9. The five actual Python groups report229 passed/19 skipped; native scheduler/SQLite TypeScript tests report432 passed/0 skipped. Python discovery reports3 passed/2 POSIX-only skips. Frontend rebuild, verification and all post-actions succeed. These are the job’s selected tests, not the entire Windows suite.
• Remaining qualification: mandatory Python run38348478389 remains incomplete: two pytest shards are running and two are queued. Coverage/JUnit/final gate and opted-in transport/certificates/outcome/inventory/cost stay unqualified. Earlier failures/skips remain historical. CQR cqr_10e8d5beafba6f8c14f7 still fails for the full mandatory hosted gap; no extra dispatch/rerun/cancellation/Release write/main merge/global install/runner/budget change.
• Future-facing pass: reuse the existing Python owner, newline handling, interpreter selector and main fixes. No new scheduler, capability, persistent control-plane contract or framework; CI report vocabulary remains local. This completed source proposal stays formal while review and operational qualification proceed.

桌面编译完成后，独立 Ubuntu publisher 仍可能排队。本提案增加默认关闭的 publication_probe，在已准入 Windows builder 上只读验证四资产与证明；probe 模式禁用原 publisher，不写 Release，publicationAuthorized 始终为 false。激活须使用已评审 ref、既有公开 tag 并显式设 true；省略或 false 恢复原 publisher，回退沿既有恢复规则。

当前组合接入主干已合并的夹具、不变量、计时及 PowerShell 单命令选择修复；原五文件及 Python 校验 owner 保持原样。九组真实资产/换行/拒绝测试、五项解释器测试、两条实际 CLI 默认关闭拒绝和全工作流关闭态对等通过；4直接/19风险与静态边界检查通过，精确 CQR 因新 head 的 hosted 验证未完成继续失败。

旧 fa3 全量 run 实际终态是 cancelled，三片取消、另一片4项失败，保留其27 jobs和原日志。当前配置/launcher 两整模块在缺 PowerShell 时31通过/13跳过；补入校验过的官方临时 PowerShell 后44通过/0跳过，包含多 Node 路径。macOS 上的实际执行不冒充 hosted Windows；旧失败和跳过均保留。

当前 head 的自动 desktop run38348478463（attempt1）已完整成功：Windows/macOS 两个 job 各通过九组真实 Python owner 预检、无签名预览构建、上传和 job post-actions。实际测试树是 head2b856 合入 main60d 的 merge9c3cb7c9，与 PR head 的整树 SHA 一致；两份预览包 digest 与上传日志匹配。probe capture／attestation／verify 和 Release publisher 全部 skipped，不能算签名发布或手动探针完成。

当前真实 Windows job115141960996（run38348478389 attempt1）已完整成功，日志确认同一 head-equivalent merge9c3。五组 Python 测试229通过／19跳过；原生调度器与 SQLite TypeScript 测试432通过／0跳过；Python 发现3通过／2项 POSIX 专用跳过，前端重建、校验与全部 post-actions 成功。这是该 job 的选定测试，不代表完整 Windows 测试集；此前 macOS44项实际 PowerShell 验证独立保留。

完整 Python run 仍未完成：两片 pytest 执行、两片排队。coverage／JUnit／最终门、真正 opt-in 下载与证书、发布结果／库存／成本仍未验，CQR10e8 继续 hold。旧失败与跳过保留，不改冻结标准或宣称组织级发布最高优先已成立。不额外派发长 CI、不合并／发布／全局安装或调整 runner；正式评审与资格 hold 分开，不因缺评审留 Draft。