Agent Publish Control Plane

Approval, provenance, and destination routing for artifacts created by humans and agents. Public status stays visible here; operator manifests, events, approvals, and publish runs require a token.