Phase Q: sc-publish package parity, install/publish cutover, and RC-provenance consume

[randlee]

Summary

Merges integrate/phase-q into develop, closing out Phase Q (sc-compose adopts sc-publish as its canonical, consumer-only publishing package).

• Q.1 — sc-publish package parity
• Q.2 — sc-compose install and publish cutover
• Q.3 — consume sc-publish develop update
• Q.4 — consume sc-publish release-candidate provenance update
• PR chore: revendor release-candidate publish workflow #530 — revendor release-candidate publish workflow
• PR fix: remove duplicate Phase Q publish logic #532 — remove duplicate Phase Q publish logic (fixes phase-ending-review blocking findings: dead .github/actions/extract-published-sc-compose/, duplicate scripts/ci/validate_publish_order.sh)
• PR chore: revendor sc-publish version-floor fix #533 — revendor bootstrap version floor (upstream sc-publish fix, re-vendored per RULE-012 rather than hand-patched)

QA history

• Phase-ending review (PHASE-Q-ENDING-REVIEW-01, quality-mgr 5-reviewer gate): initial FAIL (2 Blocking + 3 Important) → fixes landed as PR fix: remove duplicate Phase Q publish logic #532 → re-QA PHASE-Q-FIX-01-QA1 PASSed 5/5 (100%).
• Version-floor RULE-012 saga (PR fix: reject stale sc-compose Python bindings below version floor #531 hand-edit rejected twice by req-qa/arch-qa) resolved by filing/merging upstream in sc-publish and re-vendoring (PR chore: revendor sc-publish version-floor fix #533), consistent with the repo's vendoring boundary rules.
• Production-readiness review (PHASE-Q-PRODUCTION-READINESS-01, comp, read-only): PASS at integrate/phase-q bd782cf — 0 findings, byte-identical vendor parity confirmed, CI 14/14 green.

Test plan

• Phase-ending QA gate PASS (req-qa, arch-qa, rust-qa-agent, simplification-reviewer)
• Production-readiness review PASS
• CI green on this PR