Add archive promotion locks

docs/internal/stage-archive.md

@@ -8,6 +8,7 @@ Inputs:
 - session manifest and prerequisite stage records
 - run root contents under `runs/{run_id}/`
 - promotion rules with artifact `source` IDs and archive `dest` paths (`archive.promote_artifacts`)
+- source-based promotion locks (`archive.locks`)
 - session-level `previous/**` cache files when present
 
 Outputs:
@@ -23,6 +24,7 @@ Owns:
 - Prerequisite stage success enforcement
 - Run file collection and upload (excluding `audio/`)
 - Promotion rule resolution and upload
+- Promotion lock enforcement
 - Session previous-cache file collection/upload
 - Commit pointer publish order
 
@@ -34,6 +36,7 @@ Does not own:
 - `pipeline.archive.enabled`
 - `pipeline.archive.upload_run`
 - `pipeline.archive.promote_artifacts`
+- `pipeline.archive.locks`
 - `pipeline.storage.s3.bucket`
 - `pipeline.storage.s3.root_prefix`
 - `pipeline.workspace.root`
@@ -47,9 +50,11 @@ Does not own:
 - Requires `prepare`, `transcribe`, `merge`, `polish`, `normalize`, `trim`, and `analyze` status `succeeded`.
 - Resolves bucket/prefix from manifest identity first, then config fallback.
 - Uploads session `previous/**` files as durable session state when the local `previous/` directory exists.
+- Skips top-level promotion uploads for sources listed in `pipeline.archive.locks`; run-local uploads still publish.
 - Writes metadata including:
   - upload counts/paths
   - `previous_files_uploaded` and `previous_uploaded_paths`
+  - `locked_promotion_count` and `locked_promotions`
   - `current_manifest_key`
   - `current_run_id_key`
   - `current_pointer_written`
@@ -60,7 +65,8 @@ Does not own:
 - Runner-level skip also applies for previously succeeded stage unless forced.
 
 ## Failure Behavior
-- Fails on missing prerequisite success, missing object store when required, missing run root, missing required promotion source, upload failures, or pointer write failures.
+- Fails on missing prerequisite success, missing object store when required, missing run root, missing unlocked required promotion source, upload failures, or pointer write failures.
+- Locked required promotions are intentional skips and do not fail archive.
 - Pointer semantics are fail-safe: `current/run_id.txt` is not written if prior required uploads fail.
 
 ## Tests to Inspect Before Changing
@@ -70,5 +76,6 @@ Does not own:
 ## Architectural Invariants
 - Run upload excludes `audio/` subtree.
 - Session `previous/**` is archiveable durable input/provenance state, not run-local output.
+- Ordinary `--force` does not override archive locks.
 - `current/manifest.json` uploads before `current/run_id.txt`.
 - `current/run_id.txt` is the remote publish commit marker.