Add the release-recovery publisher command with offline controls #716

🤖 Generated by the Agentic Engineer

Problem

Two recorded tag-only releases are still unpublished (#587). The inspector can diagnose them but cannot publish. Before any workflow can be trusted with a writer credential, the publishing logic needs to exist and to be proven against every failure the parent issue names.

Smallest useful change

Add a separate publish-release-recovery command in the inspector's Go module. No workflow, flag or production credential is involved yet.

• It reuses the inspector's admission through a narrow GET-only interface instead of copying its identity checks.
• It proves push capability, takes two complete release inventories, refuses drafts and conflicting records, captures the latest release, and re-admits immediately before writing.
• It sends exactly one create-release request, with make_latest as the JSON string "false", a deterministic receipt and no generated notes or assets. It then reads everything back independently.
• A matching publication is a no-op, and an unknown write outcome fails without a retry.

Acceptance criteria

• The inspection command stays read-only and its existing tests pass unchanged.
• Native HTTP controls cover one successful request with independent readback; a matching publication at admission and at re-admission; wrong identity; a draft on a later page; a conflicting record; missing or false push proof; an incomplete or changed inventory; a changed tag or source; failed reads and writes; a malformed success; and connection loss after an accepted request, with a rerun that reconciles and sends nothing more.
• Each refusal before the write sends zero requests; each failure after it sends exactly one.
• The suite runs in the existing required test-create-release-config job.

Out of scope

The default-off workflow, its credentials, operator confirmation, documentation for operators and the release are a separate child of #602. Real recovery of the recorded incidents remains #587.