d8380ed451
Repo.publish validated entities individually and checked artifact.release_id == release.id, but never verified the published aggregate forms one consistent identity graph. It could commit a channel whose app_id differs from the release's app (a channel of app B pointing at app A's release) or artifacts whose app_id differs from the release's app — exactly the dangling/cross-app edge the acceptance forbids. Add Integrity preconditions to the publish transaction (reusing the existing len-reset/channel-restore rollback so the model is unchanged on failure): the release's app must exist, the promoted channel must belong to that app (chan.app_id == release.app_id), and every artifact must belong to that app AND name this release (a.app_id == release.app_id and a.release_id == release.id). Extend tests/repo_transaction.sx with cross-app channel and cross-app artifact cases asserting publish raises Integrity and leaves the model unchanged; the existing rollback and no-dangling assertions stay green.