fix(release): robust publisher fields, WAL-safe copy, installer tag order, pinned actions

From the full-repo Codex audit:
- The publisher read discovery fields one per line, so a report title
  with newlines shifted every later field and published a manifest
  without source.publish_date, which every client rejects (blocking all
  syncs). Read them NUL-separated, and refuse to write a manifest missing
  a field clients require.
- The snapshot builder copied the SQLite file with cp; committed data
  still in the -wal file of an open database would be missing. Checkpoint
  first (a no-op for the publisher's closed database, so the bytes and
  hash are unchanged) and refuse to copy when that cannot complete.
- install.sh took the tag from a greedy match, which on a compact
  single-line releases response picks the last tag, not the newest (it
  installed v0.2.3 over v0.2.4 in the new test). Split fields first.
- scripts/audit-msn-fundamentals.sh read the symbol map from a path that
  no longer exists and silently checked no stocks.
- release.yml granted contents: write to every job; only publish gets it
  now. Actions in the release and snapshot workflows are pinned to commit
  SHAs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3syn2fN2LNo5pvTSqc6eh

scripts/install-sh-test.sh

@@ -191,6 +191,17 @@ else
   fail "expands quoted ~ and tolerates trailing slashes"; cat "${work}/out9" >&2
 fi
 
+# 10. a compact single-line releases response still resolves the newest tag.
+printf '%s' '[{"tag_name":"ownership-snapshot-current"},{"tag_name":"v0.2.4","name":"v0.2.4"},{"tag_name":"v0.2.3"}]' \
+  >"${api_dir}/releases"
+dir="${work}/compact"
+if run_installer "$test_shell" "$installer" --dir "$dir" >"${work}/out10" 2>&1 &&
+  [[ "$("${dir}/idx")" == "idx fake v0.2.4" ]]; then
+  pass "resolves the newest tag from a compact releases response"
+else
+  fail "resolves the newest tag from a compact releases response"; cat "${work}/out10" >&2
+fi
+
 if ((failures > 0)); then
   echo "install.sh tests: ${failures} failure(s) with ${test_shell}" >&2
   exit 1