P3.4a: dist ci publish happy path + persistence (manifest->store->validate->publish->db.json->JSON)

Real local publish success pipeline replacing the ci-publish stub: validate manifest,
find/create app + draft release, per-artifact content-address store (P2.2) + common
validation (P3.3) with optional manifest-declared size/sha256 (PO ruling), publish via
the repo integrity transaction with channel promotion + audit events (P2.3), persist
db.json (P2.3), emit stable JSON (release id, artifact ids, sha256, file:// URLs) with
--json purity. make publish-example target + tests/publish_happy.sx (fail-before/pass-after).

Salvaged from a worker that completed the work (make test 10/10) but hit the 50-min wall
before committing; manager-verified at ground truth (make test green, make publish-example
exit 0, stored object re-hashes to its key via shasum, db.json records release/2 artifacts/
channel/4 audit events).

Makefile

@@ -26,9 +26,13 @@ build:
 test: build
 	@SX="$(SX)" ./tests/run.sh
 
-# Placeholder for the end-to-end publish flow — becomes real in P3.4.
-publish-example:
-	@echo "publish-example: not implemented yet (becomes real in P3.4)"
+# End-to-end local publish of examples/dist.json into a fresh .sx-tmp/
+# store, emitting the machine-readable JSON result on stdout. Depends on
+# `build` so build/dist exists; the store is reset first so re-runs don't
+# collide on the release id.
+publish-example: build
+	@rm -rf .sx-tmp/publish-example
+	./$(BUILD_DIR)/dist ci publish --manifest examples/dist.json --local-store .sx-tmp/publish-example --json
 
 clean:
 	@rm -rf $(BUILD_DIR)