Harden experimental publisher: make release mutation push-only

[mark-e-deyoung]

Problem

The public compile-observer workflow correctly uses pull_request for low-privilege build/test feedback, but the publish-experimental job currently also permits a same-repository pull_request path and grants that job contents: write.

That is broader than necessary for the rolling semper-exp-current channel. A PR should be able to compile/test the candidate, but PR execution should not move a tag, replace release assets, or otherwise mutate the public distribution surface.

Related: draft PR #1.

Required change

Keep the existing PR-triggered observer/Linux/Windows build gates, but make release mutation push-only:

publish-experimental:
  if: github.event_name == 'push' && github.ref == 'refs/heads/semper/compile-observer'
  permissions:
    contents: write

The downstream unauthenticated public-channel verifier should be gated consistently so it only follows a publisher run that can actually mutate the rolling channel.

The existing source-snapshot workflow is already push-triggered and should remain so.

Safety / rollout

Do not patch semper/compile-observer directly merely to fix this, because a direct push to that branch is itself the release trigger and would advance the rolling candidate identity. Prepare/review the workflow-only change on a separate branch/PR, then merge it deliberately when the engine candidate/promotion state is ready.

Acceptance

• PRs against the pinned review base can build/test without write-capable release mutation.
• Only a push to semper/compile-observer can move semper-exp-current or replace release assets.
• Source-snapshot publication remains downstream of a successful push/release gate.
• No engine source, proprietary data, or private validation evidence is involved in this hardening change.

This is release-surface hardening, not an OXCE semantic change.