chore(release): promote content publisher hardening

[allenwoods]

Summary

• promote the reviewed content publisher provenance hardening from v0.1-dev/hackforger to prod
• keep the release limited to deploy/content/README.md, deploy/content/publish-overlay.sh, and deploy/content/tests/run.sh
• preserve the content-only release boundary: no application redeploy and no legacy landing sync

Verification

• PR fix(deploy): avoid full private provenance downloads #202 merged with exact head 6ea886ebfa1e8a758e4b0655efc6e14ef806a481
• default branch merge commit fa4fa62cb3b7ccee68dec958c98acb3991d96145
• publisher tests: 31/31 passed under Bash 3.2
• public-boundary tests: 53/53 passed
• production dry-run completed without modifying backup, lock, staging, live, or marker files

Safety

• do not run redeploy.sh
• do not run the legacy landing sync
• production apply remains a separate, pinned private-content release step after this promotion