v0.7.0-rc.13

Immutable protocol cut for TASK-1173 / REQUIREMENT-076.

Adds explicit single-owner workflow publication configuration and animus.publication-receipt.v1, including generation fencing, independently observed remote proof, recovery refs, pull-request proof, schema exports, fail-closed validation, and explicit legacy migration diagnostics.

Source PR: #6