Fix subscription publication verification and freshness

[squarepots]

Summary

• verify the complete supported subscription payload and record the exact verified publication fingerprint/body digest
• reconcile the live subscription endpoint before deployment so retries skip an already completed remote mutation
• keep token rotation on the existing PendingToken across partial failures and finish local artifact recovery without another rotation
• report local render, verified publication, and client-refresh state separately
• persist per-target migration publication progress across intent, external mutation, verification, and local completion
• persist rollback intent before rollback work and resume interrupted rollback from the incomplete publication target
• keep schema-1 migration checkpoints compatible with legacy publication_attempted state

Tests

• large-body verification at 8 KiB, 8 KiB + 1 byte, supported maximum, and mismatch
• publication freshness and client-refresh freshness as independent observations
• verified remote publication followed by local state failure, with retry proving no second Worker mutation
• token-rotation commit and artifact failures, with retry proving no new token or repeated remote mutation
• migration failures before external mutation, after external mutation, and after verified publication
• rollback intent durability, interrupted multi-target rollback resumption, and legacy migration checkpoint recovery

Version impact

patch — fixes existing subscription publication, recovery, drift, and migration behavior.

Closes #39