feat(publish): retain completed work and recover interrupted publication

[kmbroai]

Summary

Interrupted publication can repeat embedding requests or lose the local receipt for an issue already created. Persist reusable work and reconcile retained outcomes before retrying publication.

Changes

• Cache validated embedding chunks by provider, model, and content. Commit custom import receipts with inserted findings so a matching idempotency key returns the original result.
• Retain Cloud upload preparation and acknowledged outcomes, including the converter version used for CSV imports.
• Return accepted custom-upload receipts with a warning if local checkpointing fails, including cancellation after acceptance. Preserve receipts through workflow dedupe success and failure without storing transient warnings in its result cache.
• Journal Linear batches and issue outcomes as publication progresses. The existing --skip-existing option recovers confirmed results and retries known failures or work that never started.
• Preserve Linear requests and receipts outside temporary publisher directories. Bind recovery to the originating attempt, record completion before cleanup, and stop retries while remote outcomes remain unknown.
• Refresh Windows shard weights from measured file runtimes to rebalance the existing seven shards.

Testing

• Passed on the final combined stack: 360 Python tests for SQLite persistence, scan recovery, retained findings, workflow state, and helper commands.
• Passed on the final combined stack: 39 workflow integration tests covering checkpoint reuse, cancellation, publication, process ownership, database aliases, and saved-artifact preservation.
• Passed: generated-model checks, SDK/MCP types, formatting, builds, installed-package verification, Ruff, and portable source checks with their tests.
• Three native reviews and independent verification passed for this PR's exact base and head.
• Full SDK suites run on Linux, macOS, and Windows in the linked CI checks.

Risk and rollout

Depends on #851 (scan resilience). Adds an append-only SQLite migration. Default Linear publication still creates new issues; recovery uses the existing --skip-existing option. Custom services need the matching receipt contract for safe replay. Unknown remote outcomes require reconciliation; Cloud retains uncertain attempts and warns before manual resubmission. Local receipts do not serialize independent concurrent publications.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-10T02:24:30.523707Z	c8c5225	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.