Separate artifact publish from deployment secrets

[shiny-code-bot]

Summary

• let artifact publication consume Launchplane's build-only typed payload without requiring deployment DB/master secrets
• preserve full stack required-key enforcement for runtime/deploy commands
• continue validating stack-required artifact build keys after repo-owned artifact-input overlays
• document the non-secret artifact payload boundary and add a full publish regression

Failure Evidence

CM workflow run 29626583285 failed before build with trace launchplane_req_568fa32b9add4111bbeca7301917bc05 because devkit required ODOO_MASTER_PASSWORD, ODOO_DB_USER, and ODOO_DB_PASSWORD. Launchplane's artifact-input route intentionally returned only ODOO_VERSION and base image inputs. No deployment occurred.

Validation

• focused publish build-only, post-overlay required-key, and local runtime secret-gate tests: passed
• uv run python -m unittest tests.test_runtime — 98 passed
• uv run python -m unittest discover -s tests — 214 passed, 1 skipped
• uv run ruff check --no-fix .
• uv run ruff format --check .
• uv build
• uv run platform --help
• PyCharm changed-files inspection: GREEN
• independent design/compatibility review: CLEAN

After merge, the exact failed CM main-branch artifact workflow will be retried. Success is required before closing #85.

Refs #85