Fix CK-07R1 planner-selected large publication path

[douglasmonsky]

Summary

Correct the CK-07R1 synthetic lifecycle benchmark so each chunk follows the exact plan_refresh result:

• APPEND_SAFE_SMALL remains on the pointer-coordinated small writer path.
• APPEND_SAFE_LARGE uses isolated-artifact build, validation, durable promotion, recovery, rollback, and prior-readability checks.
• Plan identity, TailLimits, planner reasons, pointer/request bindings, committed chain, and independent lifecycle-fold truth remain fail-closed and receipt-bound.

The root cause was an unconditional APPEND_SAFE_SMALL expectation in the benchmark even though the unchanged production planner correctly selects APPEND_SAFE_LARGE for the standard 1,369-record workload.

Scope

Only the exact CK-07R1 candidate cohort is committed:

• src/codex_usage_tracker/agent_kernel/publication/preparation.py
• scripts/benchmark_ck07r1_lifecycle_scale.py
• tests/agent_kernel/publication/test_lifecycle_scale.py

Preparation SHA-256: 66c015de949a6c380bd49964cb6c48c30dee64ecb14074b480837c44024328ea

Validation

• Authority consumers: 99 passed.
• Focused lifecycle/planner/writer/recovery tests: 204 passed.
• Broader publication/storage/privacy/scope tests: 312 passed.
• Full repository suite: 1,581 passed, 1 skipped.
• Performance invariants: 13 passed.
• Ruff, mypy, Pyright, console checks, release checks, package build, and distribution checks passed.
• sdist: 916,639 bytes (2,000,000-byte ceiling).
• wheel: 388,537 bytes (1,000,000-byte ceiling).
• Bounded implementation review: no findings.
• No CK-07R1 qualification command was invoked; no child, token action, output JSON, or receipt was created.

The preserved terminal V1/V2 ledgers and V2 stdout/stderr remain immutable local evidence and are not part of this implementation commit.