fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions

From the full-repo Codex audit:
- The publisher read discovery fields one per line, so a report title
  with newlines shifted every later field and published a manifest
  without source.publish_date, which every client rejects (blocking all
  syncs). Read them NUL-separated, and refuse to write a manifest missing
  a field clients require.
- The snapshot builder copied the SQLite file with cp; committed data
  still in the -wal file of an open database would be missing. Checkpoint
  first (a no-op for the publisher's closed database, so the bytes and
  hash are unchanged) and refuse to copy when that cannot complete.
- install.sh took the tag from a greedy match, which on a compact
  single-line releases response picks the last tag, not the newest (it
  installed v0.2.3 over v0.2.4 in the new test). Split fields first.
- scripts/audit-msn-fundamentals.sh read the symbol map from a path that
  no longer exists and silently checked no stocks.
- release.yml granted contents: write to every job; only publish gets it
  now. Actions in the release and snapshot workflows are pinned to commit
  SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/build-latest-ownership-snapshot.sh

@@ -163,8 +163,11 @@ DB_PATH="$XDG_DATA_HOME/idx/ownership.db"
 printf 'Discovering latest supported IDX/KSEI above-1%% report...\n'
 "$IDX_BIN" -o json ownership discover --family above1 --limit 50 > "$DISCOVERY_JSON"
 
-discovery_payload="$(
-    jq -r '
+# NUL-separated, so a field containing newlines (a report title) cannot
+# shift the fields after it. Written to a file: command substitution drops
+# NULs, and a jq failure must still stop the script under set -e.
+DISCOVERY_FIELDS="$WORKDIR/discovery-fields"
+jq --raw-output0 '
         if type != "array" or length == 0 then
             error("ownership discover returned no reports")
         else
@@ -184,9 +187,8 @@ discovery_payload="$(
               ]
             | .[]
         end
-    ' "$DISCOVERY_JSON"
-)"
-mapfile -t discovery_fields <<< "$discovery_payload"
+    ' "$DISCOVERY_JSON" > "$DISCOVERY_FIELDS"
+mapfile -d '' -t discovery_fields < "$DISCOVERY_FIELDS"
 
 DISCOVERED_FAMILY="${discovery_fields[0]:-}"
 DISCOVERED_LISTING_PAGE_URL="${discovery_fields[1]:-}"
@@ -308,6 +310,14 @@ jq \
             original_filename: ($original_filename | if . == "" then null else . end)
         }
     ' "$MANIFEST_PATH" > "$TMP_MANIFEST_PATH"
+# Clients reject a manifest missing any of these, so a bad one would block
+# every `idx ownership sync`; refuse to produce it.
+if ! jq -e '[.source.pdf_url, .source.title, .source.publish_date, .snapshot.version]
+        | all(type == "string" and (gsub("^\\s+|\\s+$"; "") | length > 0))' \
+        "$TMP_MANIFEST_PATH" > /dev/null; then
+    echo "built manifest is missing source.pdf_url, source.title, source.publish_date, or snapshot.version" >&2
+    exit 1
+fi
 mv "$TMP_MANIFEST_PATH" "$MANIFEST_PATH"
 
 printf 'Prepared release-ready snapshot from %s (%s)\n' \