[Tarzelf]

The completed camera/action payload could not reach publication staging because the path allowlist rejected all 16 registered negative-control archive names containing underscores. Admit exactly those names: confirmation groups 00/01, goals 0/1, student controller and the four registered faults. Other underscore-bearing paths remain rejected; the existing relative-path, roster, schema, byte/hash, checksum and credential-boundary checks are unchanged.

This is a maintainer publisher fix stacked on feat/piper-camera-action-v01. The publisher runs from this PR's commit against the existing payload whose delivery source remains d89b24c82b7534a439bbaa3cac3ef5c9d3b80088; the registered runtime remains c9a7c55531533f60e24651a99d509f721e195051. No prepared archives, source/wheel, cards, model, frozen runtime or qualification result change, and no expensive preparation rerun is needed. Full byte/secret/checksum staging is still required before upload.

Validation: the regression reproduces 16 rejected paths and the staging refusal before the fix. All 21 publisher tests and 45 preparation/card/hardware/renderer tests pass afterward, including malformed paths, checksum tampering, changed payload bytes and refusal before credential access. Independent review reran the publisher suite and checked 1,500 bounded negative-path combinations: exactly the 16 registered paths are newly admitted. A read-only path check against prepared manifest SHA-256 8d1c4c276354ca0ad3dd2b54737860950e89cf5082f0fffff59a60e79ba0eafc admits all 473 listed files and exactly those 16 additions. This check read no archive bytes and performed no upload, credential access, simulation or fitting.