Roadmap item 4: Add inactive dormant publisher payload

[yihanzhu]

Summary

• Add a pure, inactive publisher-claim normalizer.
• Bind repository, change request, attempt, idempotency, head/base/tree, allowed paths, CI, review, decision, time, and execution boundary.
• Keep permit, deny, and inconclusive claims as unqualified data with no authority.

Scope

Tracks Roadmap item 4 without closing an intake issue. This is one payload-only unit. It adds no adapter manifest or profile binding; the default-profile assembly follows after every payload has a durable main identity.

Safety

The payload is inactive, offline, and dormant. It has no credential, network, capability, permission, tool, merge, publish, activation, or external-write effect. It is separate from the temporary construction publisher gate.

Targeted proof

• dormant publisher matrix: 64/64
• portable-core schema: all categories pass with zero failures
• ShellCheck 0.11.0, bash syntax, rename, and diff checks pass

The preserved one-concern branch was adopted by merging current main normally. It was not rebased or force-pushed.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: d30f007
Reviewed-base: 956856d
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/227-92992/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The dormant publisher normalizer consistently validates claim shape, trusted bindings, content identity, and inert authority ceilings. The focused tests and restore manifest updates align with the new payload, with no actionable correctness issues found.