Separate publish transfer and commit mechanics

docs/internal/stage-publish.md

@@ -30,7 +30,10 @@ Exact remote placement and the operator workflow belong in
 manifest-derived archive metadata, confined opening, and checksum validation
 live in `publish_sources.go`; artifact-catalog matching, selection, required
 and optional rules, destination resolution, and collision inputs live in
-`publish_outputs.go`.
+`publish_outputs.go`. Copying, hashing, immutable upload, reuse checks, and
+remote verification live in `publish_transfer.go`; committed-manifest,
+immutable-commit, and current-pointer encoding and writes live in
+`publish_commit.go`.
 
 - when publishing or run upload is disabled, completes successfully with no
   outputs and records explanatory metadata. This is not an explicit self-skip:
@@ -122,6 +125,7 @@ The commit boundary and cleanup gate are normative architecture invariants; see
   helpers.
 - Implementation and tests: `internal/stage/publish.go`,
   `internal/stage/publish_sources.go`, `internal/stage/publish_outputs.go`,
+  `internal/stage/publish_transfer.go`, `internal/stage/publish_commit.go`,
   `internal/stage/publish_test.go`,
   `internal/stage/semantic_contracts_delivery.go`,
   `internal/app/operator_helpers_test.go`, and