fix(ownership): make publisher RESULT contract hold on every path

Addresses review on #29:
- drop errtrace: a failure inside $(...) printed two RESULT lines
- explicit failures go through fail(), which always prints
  RESULT: FAILED stage=...; idx check gets its own `preflight` stage;
  the never-failing published-manifest read is no longer a stage
- validate the built latest_as_of_date (`// empty` + date regex) so a
  corrupt manifest cannot compare as "newer"
- freshness: validate --now (exit 2) and latest_as_of_date (exit 3)
  before calling date
- flake: package an explicit script list instead of scripts/*.sh
- docs: GH_TOKEN prerequisite for the packaged publisher

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017a5Cv5Z1NzdYKgKnTiAF4E

flake.nix

@@ -62,24 +62,26 @@
           jq
           sqlite
         ];
+        publisherScripts = [
+          ./scripts/build-ownership-snapshot.sh
+          ./scripts/build-latest-ownership-snapshot.sh
+          ./scripts/publish-ownership-snapshot.sh
+          ./scripts/check-ownership-snapshot-freshness.sh
+        ];
         ownershipPublisher = pkgs.stdenvNoCC.mkDerivation {
           pname = "idx-ownership-publisher";
           version = cargoManifest.package.version;
           src = lib.fileset.toSource {
             root = ./.;
-            fileset = lib.fileset.unions [
-              ./scripts/build-ownership-snapshot.sh
-              ./scripts/build-latest-ownership-snapshot.sh
-              ./scripts/publish-ownership-snapshot.sh
-              ./scripts/check-ownership-snapshot-freshness.sh
-            ];
+            fileset = lib.fileset.unions publisherScripts;
           };
           nativeBuildInputs = [ pkgs.makeWrapper ];
           dontBuild = true;
           installPhase = ''
             runHook preInstall
             mkdir -p "$out/libexec/idx-ownership" "$out/bin"
-            cp scripts/*.sh "$out/libexec/idx-ownership/"
+            cp ${lib.concatMapStringsSep " " (script: "scripts/${baseNameOf script}") publisherScripts} \
+              "$out/libexec/idx-ownership/"
             chmod +x "$out"/libexec/idx-ownership/*.sh
             patchShebangs "$out/libexec/idx-ownership"