Complete promotable GitOps publication (#156)

[AntoineToussaint]

Closes #156.

Summary

• Enforce the released promotable plugin contract with typed secret references, exact output-profile verification, and optional no-deployment responses only outside required GitOps capture.
• Publish and preserve immutable service-snapshot lineage, reject generator or signed-publication byte drift, and confine clone mutations against repository symlinks.
• Render only the selected environment bootstrap with its shared dependencies, keep remote direct apply prohibited, and exercise local Argo plus remote AWS-shaped publication paths.

Test plan

• go test ./... -count=1
• go test -race ./... -count=1
• go vet ./...
• golangci-lint run --tests=false --new-from-rev=origin/main ./... using a temporary v2-migrated copy of the checked-in v1 config (0 changed-code issues)
• CODEFLY_GITOPS_K3D_QUALIFY=1 go test ./pkg/gitops -run ^TestLocalK3dDisposableGitQualification -v -count=1 -timeout=12m

The installed golangci-lint v2 cannot load the repository's checked-in v1 config directly; a repository-wide run with the migrated config reports 276 pre-existing findings, while the changed production code is clean.

Risk

Publication creates or fast-forwards codefly/snapshot-<module>-<environment> before module generation so Argo fetches the exact reviewed SHA. If generation fails, that immutable snapshot remains available for a safe retry; publication never force-pushes it.