feat(DEN-3159): preserve exact Leddy histories and harden publishers

[ORESoftware]

Summary

Preserve the complete recovered Git histories for the still-missing led-dynamo/leddy-sync and led-dynamo/leddy-mcp-server.rs repositories, while semantically merging the safer publication behavior into the existing directly reviewable seeds.

Changes

• retains the existing tested Rust source and Zed manifests;
• adds authenticated gh or environment-token publication without embedding credentials in Git remotes;
• fails closed on an existing target, dirty/non-main worktrees, prerequisite failure, or an unrelated origin;
• preserves exact Git bundle carriers for recovered heads:
  • leddy-sync: eae9e063c693d2f5e89844acf15c4e014100d976
  • leddy-mcp-server.rs: 6b8df986bcdd37a3aafdd1a97e1703c8db0379f6
• documents deterministic reconstruction, SHA-256 validation, git bundle verify, and publication order.

The bundle carrier blob IDs were compared with locally computed Git blob IDs after publication:

• leddy-sync.bundle.b64: 7de93967b3ba4ca28c49d0ff41e8c07a8dcb8b3d
• leddy-mcp-server.rs.bundle.b64: efd9e71419510337251a83547a6fa287397f9c31

Safety

• no force push;
• no rebase or history rewrite;
• no existing branch or repository overwritten;
• no credential value committed or persisted;
• target repository creation is not claimed and remains tracked by DEN-319.

Refs DEN-2884, DEN-2885, DEN-3159, DEN-319.