Gates before a floodplain item pins a habitat build: run_uid, dirty trees, versioning, public read #334

If done: before a published floodplain item pins a habitat build, PUBLISH refuses builds that cannot be named or reproduced, habitat/ keeps history, and opening it to the public is a reviewed config change. If never: a consumer can record a build that has no run_uid, was built from a dirty tree, or has since been overwritten in place.

#308 staged the export private and deliberately permissive so the machinery could be built and tested on today's logs (operator, 2026-10-14):

• run_uid: today every logged fresh_default build has none (direct wsg_run_one.R runs). Gate: PUBLISH refuses a part whose groups' runs lack a run_uid. A dispatcher build (study_area_run.sh) of the groups to publish comes first.
• link_dirty: 23 of 65 fresh.log rows and LARL/PINE in fresh_default are dirty. Gate on it, and on test-looking run_labels.
• Thresholds: only builds after Per-bundle habitat thresholds CSV in config.yaml #282 logged them; earlier builds publish NA ratios. Decide whether PUBLISH requires thresholds_logged.
• History: fresh-bc versioning is Suspended and bucket-wide (a bucket-level decision tracked with the infrastructure). When it is on, the manifest records each part's versionId and habitat/ gets a keep-the-last-N rule.
• Public read: one entry in fresh-bc's public_read_prefixes and a tofu apply, after the account's budget and anomaly alerts are in place (anonymous egress is billed once the free tier is used). lnk_catalog() already reads https.
• A per-group streams digest at run finish would let the export prove the persisted segments are the logged build's (today, after schema_consolidate.R, date_start order is the only evidence).

Decide these before the first build a published floodplain item pins (NewGraphEnvironment/floodplains#123, #52).

Relates to #308, #262.