Audit publication: emit bounded refusal diagnostics

[jeffhuber]

Summary

The hosted audit publisher hides every refusal behind one generic message, preventing diagnosis of the sealed #1024 publication failure. Emit Local audit publication refused [CODE]. from a fixed catalog covering all 73 literal refusal reasons. Unknown reasons, dynamic arguments, exception subclasses, and non-Refused exceptions emit only INTERNAL_ERROR.

AST checks enforce literal catalog coverage and the output boundary. Runtime regressions cover every code, adversarial exception arguments, payloads, paths, response bodies, tokens, URLs, identities, standalone execution, and comment cleanup. Keep the source/tools helper bytes synchronized and document how to resolve a code against the immutable workflow SHA.

Closes #1028.

Sole source writer: Code Mower Codex (builder:codex). Independent exact-head Claude review requested with needs-claude-audit.

Validation

• 33 publication tests passed, including the actual generated gate/labeler consumers, source seals, exact-head checks, attestation, replay defense, receipt binding, cleanup, and eight new diagnostic tests.
• Ruff, privacy scan, package workflow guard, source compilation, helper synchronization, package manifest currency, and all 22 release-readiness checks passed.
• Generated-workflow actionlint passed for all 15 workflows; easy-mode smoke passed.
• Exact-head GitHub CI passed: Python 3.12/3.13/3.14 full suites, Linux/macOS containment, Board qualification, packaging and installation checks. The supplemental full local run reported failures and is not used as passing evidence; the hosted matrix supplies the completed full-suite result.
• Trusted exact-head Claude audit: PASS, zero P0/P1/P2 findings, one non-blocking P3. The locally projected metadata digest matches the successful source seal 17475ee1e0736048086c39dfbeafe247cf6b35e2c8219679391142c38894b7ec. Owner-recorded bootstrap evidence.
• Default-branch audit publication failed. The authoritative gate succeeded via the owner's bootstrap override. The owner merged this PR after recording that decision.

Risk / Rollback

Only diagnostic selection/output changes. All existing validation predicates, source seals, exact-head checks, replay defenses, receipt binding and cleanup remain intact. Reverting restores the generic refusal line.

The failed-run metadata does not identify the remaining hosted mismatch unambiguously. This PR leaves a bounded code for the post-merge replay using the already sealed #1024 metadata; it does not guess at or weaken a validation check. This diagnostic bootstrap received an explicit owner gate decision; publication of #1024 still needs to pass the ordinary seal/head/receipt checks after the diagnostic identifies the refusal.

No provider rerun for #1024, Slack canary, deployment, package publication or credential change is included. The repository owner performed the merge.

Data Or Secret Exposure

• This change does not add source, raw diffs, raw transcripts, raw provider output, tokens, or machine-specific paths to public artifacts.

[jeffhuber]

Bootstrap audit evidence

Exact head: d1613d7de2829b152878c73d550e85cc5e9b490d

The trusted self-hosted Claude audit completed with PASS, zero P0/P1/P2 findings, and one documented P3 about the intentionally narrower private failure oracle. Source run: https://github.com/codemower-ai/code-mower/actions/runs/35309591697. The reviewer seal completed with digest 17475ee1e0736048086c39dfbeafe247cf6b35e2c8219679391142c38894b7ec.

Authoritative publication still cannot complete because this PR adds the bounded diagnostic needed to identify the remaining default-branch publisher refusal. No verdict comment or reservation was written. This is recorded for a one-time owner gate decision on this diagnostic bootstrap PR only. After merge, the already sealed #1024 metadata will be replayed without another model review; the resulting static reason code will drive the precise correction.