Validate publication references and canonical cover; refresh GNN v4 custody

[docxology]

Publication rendering could report success while references, literal equation labels or an incorrect author survived into the PDF. This change requires schema-2 source-bound acceptance, resolved cross-references and the canonical CFF-derived cover; stale --accept-only evidence is rejected.

The implementation preserves typed Git-tree/mode/link staging and frozen GNN custody, adds bounded real Pandoc/crossref capability probing with descendant cleanup, pins the renderer/tool/font inputs and makes dashboard labels readable. The supplemental staging fixtures now explicitly model all five tool-version probes, including pandoc-crossref, and reject unknown probes; production and staging assertions are unchanged by that final repair.

Validation at 537ecd6b4a044e2eb565b55d5bf8b258089bf236: the exact-head workflow has all 20 required jobs successful, documentation explicitly skipped and all 15 OS/Python distribution jobs successful. Python reports 2,637 passed / 20 skipped and 91.45% coverage against the 89% floor. Native acceptance verifies all 168 topics with zero warnings/sorry; the formal audit resolves 1,596 declarations. The 356-page render has no acceptance defects. Artifact/source/template hashes, fonts, references, four figures and finite PDF views were independently reviewed. CI-generated variables are retained by hash with fail-closed before/after bookends; the packet does not retain the runtime collection cache needed for independent raw-byte reconstruction.

Historical failed renders and the prior two supplemental fixture failures remain in the evidence chronology. This PR changes no numerical witness values or scientific claim boundary. It is the prerequisite for GNN's final companion-main pin and v4.0.0 integration; reciprocal GEO pairing and GNN publication are separate gates.