Separate social candidate publisher boundary

[yvette-carlisle]

Summary

• route upstream-review public follow-ups through social_candidate instead of direct social_post actions
• add social_candidate Python/schema parity and ledger artifact-kind migration support
• sync Radar/Publisher docs and repo-local skills around source-analysis vs Publisher boundaries

Verification

• cargo make fmt
• cargo make lint-fix
• cargo make test
• cargo run -p decodex --bin decodex -- radar validate artifacts/github/social-candidates artifacts/social/x artifacts/github/reviews/openai-codex-pr-25636.review.json
• cargo test -p decodex social_candidate -- --nocapture
• cargo test -p decodex accepts_valid_upstream_review_and_rejects_bad_action -- --nocapture
• python3 -m py_compile scripts/github/contracts.py
• python3 -m json.tool scripts/github/social_candidate.schema.json >/dev/null
• python3 /Users/x/.codex/plugins/cache/hack-ink/playbook/0.3.0/scripts/semantic_drift_audit.py (agent verdict: pass)
• git diff --check