feat(publish): add final package helper

[RayJiang4S]

Summary

• add cover_policy and cover_direction metadata to script artifacts so cover/poster needs are decided during planning, not bolted on at the end
• add a publish_packager tool for packaging final deliverables, copying sidecars, recording checksums, and optionally replacing the first video frame with the selected cover without prepending extra time
• add final_package_manifest to record final package files, cover provenance, duration verification, and cover policy/direction audit metadata
• wire the helper into explainer and screen-demo publish-stage docs and pipeline definitions

Why

OpenMontage already has a publish stage and publish_log, but there is no small local helper for assembling a final deliverable package or preserving the reasoning behind cover/first-frame choices. This keeps the change scoped to publish prep rather than adding a parallel "finalizer" stage.

The cover metadata is intentionally provider-neutral: covers can come from rendered frames, generated images, generated video frames, source footage, or manual design.

Tests

• .venv/bin/python -m pytest tests/tools/test_publish_packager.py -q

[RayJiang4S]

Update from the v4 production retrospective:

• Add optional require_timing_qa package gate for final packages with material timing changes.
• Record verification.timing_qa in final_package_manifest.json.
• Show Timing QA status in FINAL_PACKAGE.md, final_package_review.md, and final_package_review.html.
• Document when to attach Visual Timing QA pages/notes before final package review.

Validation:

• .venv/bin/python -m pytest tests/tools/test_publish_packager.py -q -> 16 passed
• .venv/bin/python -m py_compile tools/publishers/publish_packager.py tests/tools/test_publish_packager.py

Note: a broader tests/contracts/test_phase3_contracts.py run currently has an unrelated provider-catalog expectation failure because the local registry also discovers doubao; that is outside this publish-packager change.