fix(capsule-pipeline): harden publication auth and reporting

[Brian Krabach (bkrabach)]

Summary

Harden the two source-owned specify workflows at the publication boundary for issue #78 follow-up work.

• Check the selected publication credential with a minimal GitHub API request before creating a branch, copying capsule files, committing, or pushing.
• Report publication failures truthfully: a failed PR-creation step may follow a successful branch push, so the issue comment no longer claims that nothing was pushed or that a PR was opened without a URL.
• Add focused executable boundary tests for both workflows covering credential preflight, successful publication, post-push PR-creation failure, URL-gated success reporting, and unchanged non-capsule reporting.

The port/consumer-side follow-up belongs in amplifier-bundle-dot-runner after this source change is reviewed and merged; this PR does not change the engine, core contracts, DOT graphs, or publication credentials.

Related evidence: https://github.com/microsoft/amplifier-bundle-dot-runner/actions/runs/34227191070 (historical issue #78 run; evidence only, not a fix or closure of #78).

Verification checklist

• AGENTS.md and the repository PR template reviewed.
• Exact diff is limited to .github/workflows/capsule-specify.yml, .github/workflows/feature-specify.yml, and tests/test_capsule_publication_boundary.py.
• git diff --check origin/main..HEAD passes.
• Focused publication-boundary tests pass: python -m pytest tests/test_capsule_publication_boundary.py -q — 10 passed.
• Tests use disposable local Git repositories/remotes and stub only the gh network boundary; real pair-integrity and shipped-gate scripts are exercised.
• No new public content class; no leak-bearing run artifacts or host paths are added.
• No observable engine/core/DOT contract change; no specs/EXTENSIONS.md entry is required.
• CI is green before merge — pending after publication.

Verification evidence

The focused harness covers both source workflows (5 scenarios each):

1. A preflight auth failure stops before local branch creation or remote push.
2. Successful publication uses the workflow's selected GH_TOKEN expression and records the PR URL.
3. PR creation failure after a successful push is reported as incomplete publication without asserting that nothing was pushed.
4. A capsule is reported as opened only when the PR step succeeds and returns a URL.
5. Non-capsule reporting remains on its existing path.

The historical run showed the capsule branch push succeeded before gh pr create returned HTTP 401: Bad credentials from GitHub GraphQL. This change deliberately does not claim that the credential was expired or revoked; it adds a bounded preflight and removes the false side-effect claim.

Notes for reviewers

• This is the source-owned workflow fix only. Do not merge this PR without explicit maintainer review; prior admin authorization covered only PRs 95, 354, and 96.
• The downstream dot-runner port is intentionally not included and must wait for this source PR to merge.
• The workflow still uses the existing publication credential selection expression; this PR does not change secrets, token values, or auth configuration.
• The issue feat(loop-pipeline): resolve family-token / glob llm_model to concrete served id #78 historical run is related evidence only. This PR does not close the whole issue or claim to prove the historical credential's expiry/app-token status.
• No breaking changes.

Generated with Amplifier

Co-Authored-By: Amplifier 240397093+microsoft-amplifier@users.noreply.github.com