results: publish hard benchmark artifacts and claim audit (#423)

[AbdelStark]

Summary

Final RFC-0016 stage: assemble a self-contained, manifest-verified, secret-scanned publication artifact set from a built anti-saturation pack and a hard-mode rerank evaluation, with an artifact index and a claim audit whose public wording follows the claim gate exactly. Closes the #417 tracker.

Linked Issue

Closes #423.

Spec / RFC Reference

• Spec section: docs/spec/11-llm-world-model-harness.md
• RFC: docs/rfcs/RFC-0016-hard-downstream-reranking-benchmark.md

Public Surface Impact

New Python API (codelewm.eval): assemble_hard_downstream_artifact_set, build_hard_downstream_claim_audit, read_hard_downstream_claim_audit, HardDownstreamPublicationResult, HardDownstreamPublishError, DIAGNOSTIC_FALLBACK_WORDING, POSITIVE_CLAIM_WORDING, and the HARD_DOWNSTREAM_PUBLICATION/ARTIFACT_INDEX/CLAIM_AUDIT schema-version constants.

New schema versions (additive): codelewm.hard_downstream_publication.v1, codelewm.hard_downstream_artifact_index.v1, codelewm.hard_downstream_claim_audit.v1.

New CLI command: codelewm eval hard-downstream-publish.

Validation

uv run pytest tests/eval/test_hard_downstream_publish.py tests/docs/test_hard_downstream_artifact_audit.py -q   # passed
uv run pytest tests/docs/ tests/eval/test_hard_downstream_publish.py tests/eval/test_hard_downstream_rerank.py tests/eval/test_hard_downstream_pack.py tests/eval/test_hard_downstream_ingest.py tests/test_imports.py tests/harness/test_output_schemas.py tests/security/test_sandbox_import_boundary.py -q   # 181 passed
uv run pytest tests/harness/ -q   # 106 passed
uv run python -m compileall -q codelewm/eval/hard_downstream_publish.py codelewm/eval/__init__.py codelewm/harness/cli.py
git diff --check

Artifact Impact

eval hard-downstream-publish writes a publication directory: manifest.json (codelewm.hard_downstream_publication.v1, parent_artifacts = pack + rerank ids), claim_audit.json (codelewm.hard_downstream_claim_audit.v1), artifact_index.json (codelewm.hard_downstream_artifact_index.v1, per-file checksums), copies of the benchmark + rerank reports under reports/, and reports/publication_secret_scan_report.json. The build aborts on any secret finding.

Deprecations

none

Caveats / Follow-ups

• No locked >=100-problem eligible slice has been published, so the claim gate is closed and the claim audit emits the diagnostic fallback wording; broad_coding_improvement_claim_allowed is false and no positive claim is added to any doc/paper (enforced by tests/docs/test_hard_downstream_artifact_audit.py).
• Running the benchmark on a real locked slice (and, if the gate opens, the paper addendum) is future research work, not a code gap — the harness and gate are complete.