Harden the verified Storybook-to-shadcn handoff

[kubet]

Summary

• reposition Compify around selected Storybook CSF source graphs and native shadcn handoff evidence
• add deterministic alias-aware graph extraction, local handoff receipts, canonical v2 artifacts, and immutable revisions
• harden private registry/authentication/browser boundaries and release supply-chain controls
• serialize concurrent publications, bound revision storage and consumer snapshots, and close publishing-domain enumeration
• add clean-consumer, Compose, distribution, migration, and Playwright end-to-end gates

Local verification on d7c6eb9

• API lint/build and 23 suites / 154 tests
• CLI build/package and 49 tests
• web lint/production build and Playwright 3/3
• fresh Compose self-host smoke and distribution smoke
• concurrent distinct publishes received consecutive immutable revisions
• authenticated namespace concealment and private token revocation
• native pinned shadcn@4.16.2 private install plus Next.js production build
• migration run/revert/reapply and API restart
• release, supply-chain, Compose, provenance, formatting, and diff checks

Release boundary

This PR does not tag, publish npm packages, or claim managed deployment/PMF. Package publication remains gated by exact-SHA CI/CodeQL, protected environment approval, trusted publisher configuration, and immutable tags. The current hosted compify.app deployment remains a separate legacy deployment until an operator deploys this source revision.

[kubet]

Post-merge verification: exact squash SHA 3506ace45ca1516ca519566a88be01e2325f7a58 passed the complete main CI run (including aggregate required, self-host/distribution/browser E2E, migrations, audits, and package gates) and CodeQL. The admin squash was needed because GitHub did not recognize the local SSH signing key (unknown_key); the resulting squash commit is GitHub-verified. External npm/production gates are tracked in #44.