Integrate cleanup into pipeline execution

docs/internal/stage-publish.md

@@ -109,8 +109,8 @@ Includes counts/lists for:
 - independent publish locks are not overridden by `--force`; every initially
   unlocked relevant source is reread immediately before current-state
   selection.
-- post-commit local cleanup is authorized by the committed publish metadata and
-  is durably recorded by the application lifecycle before any local deletion.
+- successful uploaded publication records the exact run ID, remote commit key,
+  and current-pointer key consumed by the later cleanup stage.
 
 ## Resume Semantics
 
@@ -123,9 +123,12 @@ and run identifiers are excluded. Independent remote locks remain mutable state
 and are read directly by publish at planning and commit boundaries; semantic
 evidence does not replace those safety checks.
 
-The commit boundary and cleanup gate are normative architecture invariants; see
+The commit boundary and cleanup authorization are normative architecture invariants; see
 [Architecture](../policy/architecture.md#publish-commit-boundary).
 
+Publish never deletes local state. The standalone `publish` command selects
+only this stage; a full run selects notify and cleanup afterward.
+
 ## Related Contracts And Tests
 
 - [Configuration](../config.md#publish-configuration-summary) owns output
@@ -141,4 +144,4 @@ The commit boundary and cleanup gate are normative architecture invariants; see
   `internal/stage/publish_test.go`,
   `internal/stage/semantic_contracts_delivery.go`,
   `internal/app/operator_helpers_test.go`, and
-  `internal/app/post_publish_cleanup_test.go`
+  `internal/app/cleanup_orchestration_test.go`