3.0.7: feat(cli): make template publishing update-aware

A template's Blade now lives in the package that ships it (see gp247/front),
so this side gains the tooling that keeps a published copy honest:

- TemplateSourceAudit: one implementation of "where does this template's files
  come from, and which published copies are now dead weight". A PSR-4 class, not
  a gp247_* helper, because gp247:doctor runs in the bootstrap tier before the
  helpers exist. It also owns SHELL_ENTRIES — the extension shell is core's own
  format, and three places must agree on it.
- gp247:update --publish=all no longer resurrects GP247Front on a site that uses
  another template: the four tokens targeting it are skipped (with a message)
  when nothing on the site uses that template. Typing a token by name still
  publishes it — that is the operator's own decision, unchanged.
- New token front-template (the extension shell), and destination wording that
  tells the truth for a site whose live template is something else.
- gp247:doctor gains template_source: how many published files are identical to
  the package copy and can never receive an update again.
- gp247:update points at gp247:template-prune when it finds such files. It never
  deletes them itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>