feat(portfolio): ingest producer preflight receipts

[saagpatel]

Summary

• load and validate an automation-scoped producer preflight receipt before portfolio truth publication
• allow the scheduled caller to require evidence through GHRA_REQUIRE_PRODUCER_EVIDENCE, GHRA_PRODUCER_EVIDENCE, and GHRA_PRODUCER_REPO_ROOT
• refuse publication when required evidence is absent, invalid, non-passing, dirty, or stale at publish time
• cover receipt parsing and app-to-publisher wiring without adding report flags

Verification

• uv run ruff check .
• uv run pytest -q: 2854 passed, 2 skipped
• bounded report CLI help count remains within its existing limit

Operational companion

• /Users/d/scripts/portfolio-maintenance.sh has a non-publishing --contract-dry-run mode only
• dry run fetches the designated ref, preflights the nightly checkout, verifies the canonical artifact hash is unchanged, and exits before generation
• current result is fail-closed because the nightly checkout is behind origin/main

Boundaries

• live scheduled publication behavior remains unchanged
• no canonical truth regeneration, LaunchAgent change, bridge write, or Notion write

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f3aba2b9b4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce producer guard on recovery publishes

This only applies GHRA_REQUIRE_PRODUCER_EVIDENCE to run_portfolio_truth_mode; the same module still calls publish_portfolio_truth from run_portfolio_context_recovery_mode after --apply-context-recovery without passing the loaded evidence or the requirement flag. In an automation environment that sets the guard, an operator can still rewrite output/portfolio-truth-latest.json via the context-recovery apply path with an empty producer envelope, bypassing the canonical-evidence requirement this change is adding.

Useful? React with 👍 / 👎.