Publish a COMPLETED tree (require_review flow)

Promote a COMPLETED tree to PUBLISHED.

Only meaningful when the app has require_review=True. Apps without require_review serve COMPLETED to the daemon directly and never need to publish. Calling this on an app with require_review=False is still allowed — the row gets stamped published_at/published_by — but it has no functional effect on what the daemon serves.

Status guard: only COMPLETED can be published. PROCESSING means the workflow is still writing; FAILED has nothing to ship; PUBLISHED is a no-op (idempotent).