feat(pubpunk): require resolved connector refs for write handoff

[t3chn]

Summary

• Extends the side-effect-free PubPunk publish receipt write handoff packet so it requires connector profile resolution, connector profile, and selected connector strategy refs.
• Requires those connector refs in allowed source refs and expected receipt fields before projecting Module Host receipt-write handoff refs.
• Updates smoke coverage, eval spec, PubPunk docs, crate status, work goal, report, and status while preserving the bounded host writer path.

Issue ID

N/A

Test plan

• cargo fmt
• cargo test -p punk-mod-pubpunk
• cargo test -p punk-eval
• python3 scripts/check_research_gate.py
• python3 scripts/check_work_ledger.py
• python3 scripts/check_docs_governance.py --files crates/punk-mod-pubpunk/src/lib.rs crates/punk-eval/src/lib.rs docs/modules/pubpunk.md docs/modules/pubpunk-workspace-instructions.md docs/product/CRATE-STATUS.md evals/specs/pubpunk-publish-receipt-write-handoff.v0.1.md work/STATUS.md work/goals/goal_add_pubpunk_publish_receipt_write_handoff_resolved_connector_refs_v0_1.md work/reports/2026-05-20-pubpunk-publish-receipt-write-handoff-resolved-connector-refs-v0-1.md --report work/reports/2026-05-20-pubpunk-publish-receipt-write-handoff-resolved-connector-refs-v0-1.md
• cargo check --workspace
• cargo run -p punk-cli -- eval run smoke
• git diff --check

Boundaries

• No PubPunk runtime, Module Host runtime, public CLI behavior, filesystem scanning, draft body reads, provider orchestration, API calls, browser automation, credential reads, adapter invocation, external publishing, metrics collection, PubPunk-owned receipt writing, operation-evidence persistence, event-log mutation, gate writer, proofpack writer, or acceptance claim.
• selected_next remains work/goals/goal_pause_after_brownfield_manifest_writer_first_slice_v0_1.md.

Merge strategy recommendation

• Recommended: squash
• Reason: one logical PubPunk boundary hardening slice.