Decouple publish from run manifests

docs/internal/stage-publish.md

@@ -30,9 +30,10 @@ Exact remote placement and the operator workflow belong in
   both manifests record success. Enablement and upload policy are fingerprinted,
   so changing either automatically makes the prior result non-resumable.
 - validates prerequisite stage success and object-store availability.
-- derives a deterministic run-archive allowlist from the validated run
-  `manifest.json`: declared run-local outputs, logs, generated configs, and the
-  manifest itself. Unlisted workspace files are not archive candidates.
+- derives a deterministic run-archive allowlist from the session manifest's
+  declared current-run outputs, logs, and generated configurations. References
+  outside the current run root, including canonical session files and prior-run
+  diagnostics, are not archive candidates. No run manifest is read or uploaded.
 - opens each archive candidate beneath its archive root without following
   symlinked ancestors or leaf entries, verifies that it is a regular file and
   checks a declared checksum when present, then streams the opened descriptor.
@@ -82,7 +83,8 @@ Includes counts/lists for:
   from verified descriptors; symlinks, special files, replacement races, and
   undeclared entries are rejected or ignored before uploads begin.
 - run-local diagnostics, including Notarius receipt and stderr files, are
-  archived only when recorded by the run manifest.
+  archived only when recorded by the session manifest. A run with no declared
+  current-run diagnostics legitimately uploads none.
 - publish locks are not overridden by `--force`; remote locks are revalidated
   immediately before current-state selection.
 - post-commit local cleanup is authorized by the committed publish metadata and