Remove opaque source links from output roots

[lynnswap]

Purpose

Generated headers already use human-readable platform and release directories, but the output root still exposed an opaque source-storage ID as a symlink into internal recovery state. Remove that user-visible alias and make the hidden .privateheaderkit/<source-id>/current pointer the sole immutable-generation owner.

Changes

• Stop creating or repairing top-level source links, and hydrate public generated-headers/<Platform>/<release> output directly from the authenticated hidden current generation.
• Relocate an older exact managed alias out of the output root only after authenticating its current generation. Preserve and reject foreign links, files, directories, and raced quarantine entries instead of inferring ownership from the name.
• Recognize the exact legacy-<uuid> symlink residue left in legacy-backups by an interrupted older atomic swap, then move it through post-validated hidden quarantine. Unmanaged names, destinations, and raced replacements remain preserved and fail fast.
• Represent migrated backup ownership as one marker-owned LegacyBackupRequirement: a portable SHA-256 checksum plus the single generation allowed to archive the original directory. Descendant markers inherit the requirement, so copied outputs and later generations keep detecting missing or changed backups without reusing archival authority.
• Safely unwind the older publisher state that stopped after switching hidden current but before swapping the legacy directory. Recovery detaches only the authenticated uncommitted current pointer, then uses the existing abort/discard path; the unattributed directory remains untouched for an explicit fresh migration.
• Keep the existing prepared -> pointerPublished -> committed/aborted database states while removing alias-specific recovery actions; pointerPublished now refers only to the hidden current-pointer switch.
• Update the output and migration documentation plus Publisher, Store, and end-to-end Executor coverage, including multi-source isolation, descendant generations, copied-output recovery, historical residue handling, safe unwind, and publication crash boundaries.
• Make the GRDB warning-log assertion return Sendable values so the updated Executor test surface compiles under the Swift 6.3 baseline.

Review focus

• Whether the hidden current pointer and human-readable live directory now form the complete publication contract without recreating an opaque top-level alias.
• Whether the inherited backup requirement keeps backup integrity durable while restricting the directory move to its original migration generation.
• Whether the checksum-free prepared/current/directory/previous=nil compatibility state unwinds filesystem-first and leaves all unattributed directory bytes untouched across every crash boundary.
• Whether the obsolete-link and detached-current quarantine paths preserve foreign or raced filesystem entries while retiring only authenticated PrivateHeaderKit pointers.

Testing

• swift test — 588 tests in 43 suites passed.
• Focused Publisher, Store, and Executor regressions passed for descendant backup authentication, duplicate-archive rejection, copied output, historical swap residue, and compatibility unwind into a fresh migration.
• iOS Simulator cross-builds passed for PrivateHeaderKitCore and PrivateHeaderKitCoreTests.
• watchOS Simulator cross-builds passed for PrivateHeaderKitCore, PrivateHeaderKitCoreTests, and privateheaderkit-sim-helper.
• git diff --check passed.
• Branch-wide codex-review against pinned main completed with 0 findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df41c406a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lynnswap]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 083cc5a2ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lynnswap]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: a5373ba059

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".