fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions

From the full-repo Codex audit:
- The publisher read discovery fields one per line, so a report title
  with newlines shifted every later field and published a manifest
  without source.publish_date, which every client rejects (blocking all
  syncs). Read them NUL-separated, and refuse to write a manifest missing
  a field clients require.
- The snapshot builder copied the SQLite file with cp; committed data
  still in the -wal file of an open database would be missing. Checkpoint
  first (a no-op for the publisher's closed database, so the bytes and
  hash are unchanged) and refuse to copy when that cannot complete.
- install.sh took the tag from a greedy match, which on a compact
  single-line releases response picks the last tag, not the newest (it
  installed v0.2.3 over v0.2.4 in the new test). Split fields first.
- scripts/audit-msn-fundamentals.sh read the symbol map from a path that
  no longer exists and silently checked no stocks.
- release.yml granted contents: write to every job; only publish gets it
  now. Actions in the release and snapshot workflows are pinned to commit
  SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/build-ownership-snapshot.sh

@@ -94,6 +94,15 @@ MANIFEST_PATH="$OUTPUT_DIR/ownership-snapshot-manifest.json"
 TMP_ARTIFACT_PATH="$OUTPUT_DIR/.ownership-snapshot-${LATEST_AS_OF}.sqlite.tmp.$$"
 # Remove a partial copy if the script fails before the atomic rename below.
 trap 'rm -f "$TMP_ARTIFACT_PATH"' EXIT
+# Committed data can still sit in the -wal file while another connection has
+# the database open; checkpoint it into the main file first (a no-op for a
+# closed database, so its bytes and hash are unchanged), and refuse to copy
+# when that cannot complete.
+checkpoint="$(sqlite3 "$DB_PATH" "PRAGMA wal_checkpoint(TRUNCATE);")"
+if [[ "${checkpoint%%|*}" != "0" ]]; then
+    echo "ownership database is busy; could not checkpoint its WAL before copying: $DB_PATH" >&2
+    exit 1
+fi
 cp "$DB_PATH" "$TMP_ARTIFACT_PATH"
 
 # Immutable, content-addressed name. The publisher relies on this to upload and