Publish-TF fallback has no staleness bound (live CA grid) — follow-up to #21

[rolker]

Context

Part of #21 (live GeoMapSheet draft-tile persistence + Cartesian→geographic migration).

The migrated publish path projects geographic GGGS cells into the map_frame
grid using a single map←earth affine looked up once per publish
(grid_projection.cpp, cube_bathymetry_node.cpp). To degrade gracefully on a
publish-time TF miss, the node caches the last good map←earth transform
(last_publish_tf_ / have_publish_tf_) and reuses it.

Problem

The cached-TF fallback has no age bound. During a prolonged TF outage the
node would keep republishing the live collision-avoidance grid using an
arbitrarily stale map←earth, which could misplace seafloor cells relative to
the boat. This is no worse than today's drop-on-miss behavior for new data
(ingestion still drops pings on a TF miss), but the publish side now has a
new "use stale transform indefinitely" mode that did not exist before the
migration.

Proposed fix

• Stamp the cached transform with its source time and enforce a configurable
  staleness ceiling (e.g. publish_tf_max_age, default a few seconds).
• When the cached transform exceeds the ceiling, skip the publish (and warn,
  throttled) rather than emitting a stale-projected grid to the CA feed.

Acceptance

• A unit/integration test that advances time past the ceiling and asserts the
  publish is skipped (no stale grid emitted).
• Param documented alongside draft_dir / save_interval.

---

Authored-By: Claude Code Agent
Model: Claude Opus 4.8