fix: make public-list verification labels truthful

[brianorwhatever]

Summary

• Label both public readers as live, mutable lists rather than sealed snapshots.
• Replace unsupported cryptographic verification labels with explicitly unverified supplied-proof and identifier details.
• Correct both publishing dialogs so they do not promise item-authorship verification or contributor names absent from the canonical public reader.
• Add six focused source-contract regression tests.

Related: #232 and #276. This is a presentation-only follow-up; it does not complete #232 or implement an independent sealed-snapshot verifier.

Scope

Five files only. No query, payload, authorization, privacy, migration, or publication-state changes. No public export of an internal envelope is added. Existing agents' branches are preserved.

Verification

• node --test scripts/publication-copy.test.mjs: 6 passed.
• git diff --check and reverse-patch applicability: passed.
• Independent review of the exact five-file patch: no blocking findings.
• Base refreshed at 8bfcdb78f14925c4e4e164a5f19187d9606c0fb8; no overlap with current open PRs Sign action records with owner Turnkey keys through one shared path #277 or chore(e2e): add e2e runner, example test, and CI workflow #248.
• React rendering, TypeScript/build, backend integration, and browser tests were not run locally in the source-only workspace. These source-contract tests do not establish rendered behavior, cryptographic correctness, or live readiness.

Draft for review. No merge or deployment is requested.

[railway-app]

🚅 Deployed to the boop-pr-289 environment in Friends

Service	Status	Web	Updated
boop	✅ Success (View Logs)	Web	Oct 8, 2026 at 8:04 pm UTC