review(substrate): close 2 MEDIUM concurrency gaps + trap-clean tempfiles (follow-up to #200)

[jakebromberg]

Post-merge review of #200 caught two race-condition gaps in the substrate's S3 concurrency story plus a tempfile-cleanup hole. This change closes all three with regression tests.

MEDIUM — pipeline/refresh-index.mjs retry reused stale serialized body

Brief §3.4: "each writer lists by-repo/<R>/ to compute the latest, then PUTs index.json with conditional If-Match on its ETag, retrying on 412 conflict." The previous implementation listed once at script start, serialized once, then on 412 only re-read the ETag — never re-listed. Result: byte-level CAS but not logical CAS. Writer A's eventual successful retry would carry A's view of the world, silently overwriting whatever writer B added between A's list and A's PUT.

Fix: extract the list / enumerate / serialize pipeline into a recompute() function. The first attempt uses initial = recompute(); conflict retries call recompute() again so the loser's eventual successful PUT carries the winner's view, not the loser's stale serialization.

MEDIUM — pipeline/refresh-index.mjs first-publish race had no protection

When headETag returned null (no existing index.json), putBytes omitted any precondition. Two concurrent first-publishers both succeeded; one silently lost.

Fix: pass --if-none-match '*' whenever ifMatch is null, so even the create-vs-create race triggers a 412 and routes through the same retry path.

LOW — pipeline/publish-catalog.sh tempfile cleanup not exception-safe

Three /tmp/publish-catalog-*.$$.* tempfiles were only removed on the happy path. Under set -eu, any failure mid-pipeline (validation, upload, jq) bypassed the explicit rm -f calls.

Fix: add a trap '...rm -f ... EXIT' at the top of the script. Explicit rm -f calls remain as happy-path belt-and-suspenders.

Test plan

• Extractor: 97 / 97
• Canonical: 26 / 26
• Integration: 124 / 124
• gojq parity: 54 / 54
• Substrate: 58 / 58 (was 56; added byte-stability check on recompute() and a tempfile-leak regression check on publish-catalog.sh)
• shellcheck clean on all four substrate shell scripts

Refs #152, #153, #200.