Fix append capability publication proof

[KimGLee]

Fixes #172

What changed

• Treat an admitted missing append target as an initial fact rather than a permanent publication result.
• Advance the exact capability to the object selected by first publication, without sharing state across append and transaction capabilities that happen to use the same path spelling.
• Bind final receipt observation to both the retained object and the unique final name.
• Propagate advanced capability descriptors and the corresponding manifest state through run_cambium_subprocess.
• Update the shared-library and path-capability contracts and regenerate the module-boundary manifest.

Why

Publication proof must follow the authority state produced by the current operation. Keeping only the admission-time state makes first creation and nested execution disagree with later observation. The shared capability layer is the correct owner; individual receipt-producing tools should not each patch the outcome independently.

Implementation-sensitive reproduction and timing details are intentionally omitted from this public PR.

Verification

• 7 focused first-publication, drift, partial-write, isolation, and nested-process controls passed.
• Tools.tests.test_mcp_server: 107 passed.
• Shared runtime/Queue/sealing/metadata/Gate-runner selection: 314 passed.
• Module boundaries: 17 passed.
• Clean Git snapshot full suite: 1895 passed, 1 skipped.
• make check: passed.
• git diff --check: passed.