feat(metaserver): publish authenticated presence through the canonical API

[zoeyrose]

Outcome

Publish replacement Go server presence through the versioned Game Protocol 1 route on publish.meta.atrinik.org using one certificate-bound, replay-safe request, without inheriting the classic OTP/CGI contract.

Scope

• Consume the authoritative registration/discovery schema and fixtures from atrinik/protocol#12 and the Worker implementation contract from atrinik/metaserver-worker#13.
• Use a Game Protocol 1-specific route, schema, signature domain, and key lifecycle on publish.meta.atrinik.org; never send /index.wsgi/* or classic form fields.
• Bind publisher authentication to the persistent QUIC server identity clients pin, using the one-request replay contract from atrinik/metaserver-worker#22 and shared Go/Worker vectors.
• Persist the monotonic publish sequence before sending, use a fresh nonce per attempt, and recover safely from restart, rollback, and ambiguous responses.
• Publish at startup, after debounced public-visible changes, and on a slow jittered heartbeat measured in hours. An unchanged heartbeat must not rebuild directory artifacts.
• Publish only an explicitly configured direct DNS hostname/port. A server with none remains discoverable and may use the separately threat-modeled rendezvous contract; never ask the Worker to infer the request source.
• Honor Retry-After, distinguish permanent authentication/schema failures from transient failures, and use bounded exponential backoff with jitter.
• Treat the returned rendezvous credential as short-lived secret material if Game Protocol 1 enables rendezvous; otherwise omit that capability entirely.

Acceptance criteria

• One signed HTTPS request registers/updates a Go server and passes shared protocol/Worker fixtures.
• Classic credentials, routes, schemas, signature domains, and compatibility code are absent.
• Startup/change/heartbeat behavior stays within the documented daily request envelope and never tight-loops on permanent or rate-limit errors.
• Sequence/nonce state and identity survive supported restart/backup/restore/rollback scenarios without enabling replay.
• A no-hostname server publishes no inferred address; an explicit hostname is normalized/validated and clearly opt-in.
• Unchanged heartbeats do not create new meta.atrinik.org/index.* generations; visible changes and expiry do.
• Secrets, signatures, nonces, tokens, request sources, and transient candidates are absent from logs/metrics/directory data.
• Go unit/integration/race tests, shared protocol fixtures, and production canary/rollback checks pass.

Coordination

• atrinik/protocol#12: authoritative protocol contract.
• atrinik/metaserver-worker#13: Worker adapter.
• atrinik/metaserver-worker#22: one-request publish authentication.
• atrinik/metaserver-worker#21: static meta.atrinik.org representations.
• Package and operate the Go server in production #63 owns the broader production operations/package integration.