Fix COMMAG publication tree discovery without GitHub REST API

[vtavakkoli]

Summary

Follow-up fix for the full COMMAG publication benchmark. The previous preparation path called GitHub's recursive tree REST API and could abort on transient HTTP 500 responses before any COMMAG parsing started.

Fix

• removes the publication preparation dependency on GitHub's recursive REST tree endpoint
• adds agentic_ran.publication_data with Git protocol v2 tree discovery
• uses a shallow blobless fetch (--depth=1 --filter=blob:none) for the pinned COMMAG revision, so only commit/tree metadata are fetched
• caches the discovered path list under data/raw/commag/.tree-git-<revision>.txt
• keeps the existing raw CSV cache: already downloaded non-empty COMMAG files are reused
• adds git and CA certificates to the Python 3.13-slim runtime image
• routes python -m agentic_ran.publication prepare through the new resilient preparation path
• adds a unit test proving cached tree listings are reused without network access

Why this fixes the reported failure

The reported traceback failed in urllib.request.urlopen() against:

https://api.github.com/repos/wineslab/colosseum-oran-commag-dataset/git/trees/<revision>?recursive=1

That endpoint is no longer used by the publication workflow.

Run

docker compose -f docker-compose.publication.yml down --remove-orphans
docker compose -f docker-compose.publication.yml up --build --force-recreate publication-test

No raw-data cleanup is required. Existing COMMAG downloads remain cached.