Publishes one model-authored candidate as {candidate.clj, descriptor.json}.

This is the trusted host step ComponentOverride deliberately excludes. A run emits source through channels it already has; an operator carries those bytes here. Nothing a run can influence reaches this module, which is what keeps the descriptor path unreachable from generated code.

Candidate source is treated as private unconditionally. It may have been extracted from a private result artifact, and a world-readable candidate would declassify private model output. Publication therefore reuses the same primitives as result publication: an exclusively created mode-0700 directory, files restricted to 0600 before any content is written, and ancestor ownership and permission checks. The exclusive directory create — not a rename — is the no-clobber guarantee, because POSIX rename may replace an existing empty destination directory.

Publication precedes gating: the gate re-acquires the application through the descriptor written here, so it evaluates exactly the bytes an operator would later promote. discard/1 removes the directory when the gate refuses, so a refused candidate leaves nothing behind.