fix(capsule-pipeline): align consumer publication auth and reporting

[Brian Krabach (bkrabach)]

Summary

Port the source-owned publication-authentication and reporting correction from amplifier-bundle-attractor PR #355 into the dot-runner consumer.

• Keep the existing CAPSULE_PR_TOKEN-then-github.token publication credential selection used by the workflow.
• Run a same-credential, read-only GitHub GraphQL viewer preflight before local branch creation, commit, push, or PR creation.
• Report a capsule as opened only when the PR step succeeds and returns a non-empty URL; otherwise report incomplete publication without claiming that no branch was pushed.
• In the dot-runner consumer's outcome comment, let actual capsule publication state take precedence over leftover classifier/probe residue while preserving genuine non-capsule findings and the existing classifier behavior.

This follows source PR #355, now merged:
microsoft/amplifier-bundle-attractor#355

The original issue #78 run is related evidence only, not fixed or closed by this PR:
https://github.com/microsoft/amplifier-bundle-dot-runner/actions/runs/34227191070

Verification

• Source upstream post-merge CI completed successfully before this port was published:
  https://github.com/microsoft/amplifier-bundle-attractor/actions/runs/34263919213
• Candidate head: 429f507b0a6c2e71c42b9949dfa34982db7af9ca
• Candidate was based on dot-runner main at b17ccda49a20be901119e02c2f6c2c043d7ec845; no concurrent main advancement was found before publication.
• Focused publication-boundary harness: 4 passed, 1 skipped, 6 subtests passed.
• Independent capsule-pipeline validation: 82 total, 81 passed, 1 optional external-baseline skipped.
• The original port workflow reproduced the pre-fix behavior under a simulated preflight 401: it pushed a branch despite the failed preflight. The candidate reverses that ordering.
• Four YAML documents and all 68 workflow shell blocks parsed; scoped Ruff 0.16.6 checks and formatting passed.
• Validation used extracted workflow blocks, disposable local Git repositories/remotes, the real pair-integrity fence, and shipped-gate scripts; only the GitHub gh network boundary was stubbed.

Checklist

• nlspec evidence: the change is outside engine execution (Sec. 3), worker outcome/status reporting (Sec. 4.5), context updates (Sec. 5.1), and Appendix C status-file semantics; those contracts remain unchanged. The surrounding contract keeps execution and worker outcomes in the engine/worker layers, while GitHub publication remains workflow-side orchestration using existing step outputs.
• Tests pass for the touched publication-boundary harness.
• Ruff check and format checks pass for the changed test file.
• Diff scope is exactly .github/workflows/feature-specify.yml, .github/workflows/capsule-specify.yml, and .github/capsule-pipeline/test_publication_boundary.py.
• No specs/EXTENSIONS.md, ledger/, or contracts/ files changed.
• No engine, core, DOT, status, criteria, classifier API, or new workflow policy behavior was introduced.
• No secrets, credentials, raw run artifacts, host paths, or private evidence were added.

Review notes

• This is the downstream consumer port only and was intentionally held until source PR #355 merged and its upstream post-merge CI passed.
• The preflight is a bounded read-only viewer query. A successful viewer query does not prove PR-creation permission, stored-secret validity, or explain the historical GraphQL 401.
• The change does not claim an expired PAT, installation-token failure, live end-to-end capsule publication, or closure of issue escalate is dead in Actions: HumanGateHandler requires an Interviewer, so every -> escalate edge is a trapdoor to abandon #78.
• No new engine status/API or specification contract is needed.
• No breaking changes.

Generated with Amplifier

Co-Authored-By: Amplifier 240397093+microsoft-amplifier@users.noreply.github.com