Harden release publication and UI contracts

[rovkinmax]

Summary

• adopt the schema-4 Puber release source, deterministic runtime carriers, generated canonical graph, and cleanup/Janitor contracts
• separate credential-free required checks from approval-gated tag and GitHub Release effects, with exact notes and watcher readback
• route Main search/settings through the unified action contract and require stable caller-provided paging item keys

Local verification

• test-runtime-v2-command-closure
• test-puber-release-graph
• test-workflow-puber-release-intent
• test-workflow-puber-release-publish
• test-workflow-wait-github-release
• test-workflow-release-cleanup
• test-github-release-workflow
• test-workflow-verify-report
• deterministic release builder check
• exact S05/S10 allowlists, source assertions, 120-column check, git diff --check, clean-state and remote guards

Gradle unit, Detekt, and assembly validation is intentionally delegated to this pull request's natural PR Checks workflow.

Safety

This source delivery does not apply a live Kent Workflow, change a default link, merge, tag, publish a release, install or restart Kent, or access release credentials.