fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions

From the full-repo Codex audit:
- The publisher read discovery fields one per line, so a report title
  with newlines shifted every later field and published a manifest
  without source.publish_date, which every client rejects (blocking all
  syncs). Read them NUL-separated, and refuse to write a manifest missing
  a field clients require.
- The snapshot builder copied the SQLite file with cp; committed data
  still in the -wal file of an open database would be missing. Checkpoint
  first (a no-op for the publisher's closed database, so the bytes and
  hash are unchanged) and refuse to copy when that cannot complete.
- install.sh took the tag from a greedy match, which on a compact
  single-line releases response picks the last tag, not the newest (it
  installed v0.2.3 over v0.2.4 in the new test). Split fields first.
- scripts/audit-msn-fundamentals.sh read the symbol map from a path that
  no longer exists and silently checked no stocks.
- release.yml granted contents: write to every job; only publish gets it
  now. Actions in the release and snapshot workflows are pinned to commit
  SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/audit-msn-fundamentals.sh

@@ -130,7 +130,9 @@ resolve_tickers() {
         done
         IFS="$old_ifs"
     else
-        mapfile -t TICKER_LIST < <(cut -f1 "$ROOT_DIR/src/api/msn/symbol_ids.tsv")
+        symbol_map="$ROOT_DIR/crates/idx-core/src/api/msn/symbol_ids.tsv"
+        [[ -f "$symbol_map" ]] || { echo "symbol map not found: $symbol_map" >&2; exit 1; }
+        mapfile -t TICKER_LIST < <(cut -f1 "$symbol_map")
     fi
 
     if [[ ${#TICKER_LIST[@]} -eq 0 ]]; then