CLI: gate pushes on staged remote validation

[zkwentz]

What & Why

openenv push must not validate one tree and upload another. This PR prepares the exact Space snapshot, validates that snapshot remotely with the strict publish profile, binds the report digest, and uploads the portable author report with the same revision.

Risk & Review Guidance

• Risk level: HIGH — changes the publish gate, source filtering, and credential boundary
• Task class: security
• Review focus: src/openenv/cli/commands/push.py:342 for digest binding; src/openenv/cli/commands/push.py:394 for staging/filtering; src/openenv/cli/commands/push.py:622 for upload ordering
• Blast radius: A bug can upload unvalidated files or credentials, accept forged results, or block every Hub publish.

Decisions & Alternatives

• Transform first, validate second, upload third — Dockerfile relocation, frontmatter, and excludes are inside the validated snapshot.
• Share one source-path policy with the remote archive — every uploaded source file is covered by the digest.
• Reject staged symlinks but ignore symlinks in excluded .venv/hidden paths — prevents path escape without breaking common local setups.
• Write .openenv/validation-report.json after validation — the report is portable, versioned, and explicitly uncertified.

Verification

• PASS: PYTHONPATH=src:envs .venv/bin/python -m pytest tests/test_cli/test_push.py tests/test_validation/test_remote.py -q — 70 passed after the final symlink-filter refinement.
• PASS: PYTHONPATH=src:envs .venv/bin/python -m pytest tests/ -q -m 'not integration' — 1,559 passed, 114 skipped, 31 external integration tests deselected on the complete stack.
• PASS: Fork whole-stack CI — 7/7 checks passed, including Python 3.11/3.12, lint, docs, lock validation, and package smoke tests.
• NOT verified: No live HF Sandbox smoke test was run because this machine has no HF token.

Scope & Non-Goals

• Custom registry pushes use the same strict profile locally but do not receive the Hub-versioned report.

Breaking Changes / Migration Notes

Hub pushes now require HF authentication capable of creating a dedicated Sandbox and a fully passing publish profile. Custom registry pushes now require the local strict profile.

Stack

PR 16 of 17; depends on #956.

Full 17-PR stack

1. #942 RFC 008: Spec-neutral local and remote validation architecture
2. #943 Validation foundation: spec-neutral contracts and adapters
3. #944 Validation policy: spec-aware check registry and planner
4. #945 Validation executor: hardened shared reports and eligibility
5. #946 Local validation API: execution-model-aware profiles
6. #947 CLI: validation profiles and shared reports
7. #948 HF runtime: dedicated sandbox execution mode
8. #949 HF certification: enforce trusted dedicated isolation
9. #950 [RFC 008] Define remote author validation and publish gating
10. #951 Validation: unify CLI reports and add a strict publish profile
11. #952 Validation: add structured author diagnostics and remediation
12. #953 Validation: run author validation in dedicated HF Sandboxes
13. #954 Validation: isolate submitted code in author Sandboxes
14. #955 Validation: bind author reports to policy and source
15. #956 CLI: scaffold publish requirements
16. #957 CLI: gate pushes on staged remote validation ← current
17. #958 Docs: explain local, remote, and publish validation

All upstream PRs remain draft while RFC 008 is under review.