[codex/interactive] fix(release): publish crate dependency chain

[div0-space]

Current state

Publish attempt 3 uploaded only report-leptos 0.14.4. loctree never reached upload: Cargo could not resolve its unpublished loctree-ast = "^0.14.4" dependency. The old fallback then produced a false positive because fuzzy cargo search loctree | grep 0.14.4 matched another search row, so the workflow continued and loctree-mcp failed on the still-absent loctree 0.14.4.

There was a second recovery defect: the job checks out the immutable release tag, so a poller added after that tag would not exist in the release worktree.

Change

• publish the real dependency chain: report-leptos -> loctree-ast -> loctree -> loctree-mcp
• mark loctree-ast publishable in the local release driver and include it in its publish order
• replace fixed sleeps with a bounded exact-version index poll (40 x 15 seconds)
• run registry lookups from a neutral directory with cargo info --registry crates-io crate@version, never from the matching local workspace
• check out immutable tagged source under release-src and the poller from the exact github.workflow_sha under release-control
• add delayed-visibility, timeout, call-count, unsafe-name, source/control split, and publish-order contracts to preflight

Verification

• bash tests/crates_io_index_wait_contract.sh: PASS
• bash tests/preflight_contract.sh: PASS
• ShellCheck for the changed helper/contract: PASS
• actionlint: PASS
• Semgrep: 85 applicable rules over 4 changed code/config files, 0 findings
• mandatory vc-deprivatize: repository baseline remains 1337 findings (627 CRITICAL / 177 HIGH / 533 MEDIUM); full verify still fails on 560 inherited hard findings. The only finding in a touched file is the pre-existing commit-trailer email outside changed hunks; diff delta is 0.

Recovery

After merge, start a fresh Publish Releases dispatch from merged main with tag v0.14.4. Do not rerun the old failed attempt: reruns retain the old workflow definition. The fresh run will use release-control from the merged workflow commit while publishing the immutable tagged source, skip report-leptos exactly, publish loctree-ast, then unlock loctree and loctree-mcp plus all downstream platform/thin/npm/monorepo jobs.