Preserve committed publication recovery failures

[eanz17]

Problem and solution

A workflow run can finish its steps successfully but fail while publishing the committed terminal state across a rollout. The recovery path treated that infrastructure failure as a completed run, which made committed Observatory state contradict the publication outcome.

This change preserves publication adapter failures as terminal infrastructure failures, makes the failure policy explicit, and covers both the execution boundary and fork-on-failure recovery behavior. It also refreshes the NyxID conformance source pin required by the current feature/integrate baseline.

Impact paths

• Workflow execution terminal failure handling
• Workflow run recovery after committed publication failure
• NyxID assistant conformance source pin

Verification

• Publication boundary tests: 18/18 passed
• Aevatar.Workflow.Core.Tests: 981/981 passed
• NyxID conformance guard: passed
• bash tools/ci/test_stability_guards.sh: passed
• bash tools/ci/architecture_guards.sh: passed
• git diff --check origin/feature/integrate...HEAD: passed

Production acceptance

Production remains on image b58156d, which does not contain the fix. Final acceptance requires deployment followed by a newer owner committed run; the existing HR-01 failure is intentionally not closed by this PR.

[codecov]

Codecov Report

❌ Patch coverage is 82.75862% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.54%. Comparing base (1780ce8) to head (dd37845).
⚠️ Report is 30 commits behind head on feature/integrate.

Files with missing lines	Patch %	Lines
...Workflow.Core/Execution/WorkflowExecutionKernel.cs	64.28%	5 Missing ⚠️

@@                 Coverage Diff                 @@
##           feature/integrate    #3427    +/-   ##
===================================================
  Coverage              84.53%   84.54%            
===================================================
  Files                   1536     1537     +1     
  Lines                 149899   150131   +232     
  Branches               18191    18202    +11     
===================================================
+ Hits                  126722   126930   +208     
- Misses                 14835    14853    +18     
- Partials                8342     8348     +6     

Flag	Coverage Δ
ci	84.54% <82.75%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...tion/WorkflowRuntimeInfrastructureFailurePolicy.cs	100.00% <100.00%> (ø)
...orkflow/Aevatar.Workflow.Core/WorkflowRunGAgent.cs	82.35% <100.00%> (-0.40%)	⬇️
...Workflow.Core/Execution/WorkflowExecutionKernel.cs	80.50% <64.28%> (-0.07%)	⬇️

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.