feat(ownership): idempotent, packaged snapshot publisher

The self-hosted publish timer has not produced an upload since it was
enabled (manifest last updated 2026-07-14, a manual run), and failures
were invisible. Make the job safe to run daily and easy to deploy:

- publish-ownership-snapshot.sh: skip the upload when the published
  manifest already has the latest as-of date (pre-check via discover
  for XLSX sources, post-build check for legacy PDF); --force to
  override. Always ends with one line: RESULT: published|up-to-date
  <as-of> or RESULT: FAILED stage=<stage> (exit N). gh release create
  no longer requires a git checkout.
- check-ownership-snapshot-freshness.sh: exit 1 when the published
  latest_as_of_date is older than --max-age-days (default 40).
- flake: packages.ownership-publisher bundles the scripts with a
  pinned idx (curl-impersonate + mupdf) and jq/gh/sqlite/curl as
  bin/idx-ownership-publish and bin/idx-ownership-freshness, so hosts
  need no checkout, nix develop or cargo build at run time. Built in CI.
- contrib/systemd + docs: daily 06:00 UTC timer, run semantics table,
  freshness alarm, packaged usage.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

scripts/check-ownership-snapshot-freshness.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Fail when the published ownership snapshot is older than expected, so a
+# publish job that keeps failing (or keeps finding nothing new) gets noticed.
+
+set -euo pipefail
+
+usage() {
+    cat <<'USAGE'
+Usage: scripts/check-ownership-snapshot-freshness.sh [options]
+
+Options:
+  --manifest-url <url>   Published manifest (default: the ownership-snapshot-current
+                         release of 0xrsydn/idx-cli)
+  --max-age-days <n>     Allowed age of latest_as_of_date in days (default: 40;
+                         the source is monthly and lands 2-3 days after month end)
+  --now <YYYY-MM-DD>     Reference date instead of today (for testing)
+  --help                 Show this help
+
+Exit status: 0 fresh, 1 stale, 2 usage error, 3 manifest unreadable.
+USAGE
+}
+
+MANIFEST_URL="https://github.com/0xrsydn/idx-cli/releases/download/ownership-snapshot-current/ownership-snapshot-manifest.json"
+MAX_AGE_DAYS="40"
+NOW="$(date -u +%F)"
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --manifest-url) MANIFEST_URL="${2:-}"; shift 2 ;;
+        --max-age-days) MAX_AGE_DAYS="${2:-}"; shift 2 ;;
+        --now) NOW="${2:-}"; shift 2 ;;
+        --help|-h) usage; exit 0 ;;
+        *) echo "unknown argument: $1" >&2; usage >&2; exit 2 ;;
+    esac
+done
+
+if ! [[ "$MAX_AGE_DAYS" =~ ^[0-9]+$ ]]; then
+    echo "--max-age-days must be a non-negative integer" >&2
+    exit 2
+fi
+
+if [[ "$MANIFEST_URL" =~ ^https?:// ]]; then
+    manifest="$(curl --fail --silent --show-error --location --retry 3 "$MANIFEST_URL")" || {
+        echo "FRESHNESS: unreadable manifest $MANIFEST_URL" >&2
+        exit 3
+    }
+else
+    manifest="$(cat "$MANIFEST_URL")" || exit 3
+fi
+
+as_of="$(jq -r '.snapshot.latest_as_of_date // empty' <<< "$manifest" 2>/dev/null || true)"
+if [[ -z "$as_of" ]]; then
+    echo "FRESHNESS: manifest has no snapshot.latest_as_of_date" >&2
+    exit 3
+fi
+
+age_days=$(( ($(date -u -d "$NOW" +%s) - $(date -u -d "$as_of" +%s)) / 86400 ))
+if (( age_days > 10#$MAX_AGE_DAYS )); then
+    printf 'FRESHNESS: stale latest_as_of_date=%s age_days=%d max=%s\n' "$as_of" "$age_days" "$MAX_AGE_DAYS" >&2
+    exit 1
+fi
+printf 'FRESHNESS: ok latest_as_of_date=%s age_days=%d max=%s\n' "$as_of" "$age_days" "$MAX_AGE_DAYS"