Artifact publish source-verification failures split into specific error messages

What The generic source_unverified failure shown when publishing an artifact has been replaced with a set of specific, retry-guidance-bearing error messages depending on why the source file's permission-check "pin" (its recorded approval) couldn't be verified:

• source_pin_stale_build: the approval came from an older Claude Code version
• source_pin_missing/unreadable: the approval is unmatched or missing
• approval_replayed: the approval was replayed
• source_pin_evicted: the approval was evicted from session state
• source_pin_unobserved: the permission check was never recorded
• source_check_failed: an internal check failed, for example the permission check crashed before it could record the file
• source_redirected_on_resume: the source file was redirected, via a symlink or hardlink, by another process during a resumed approval
• source_path_mismatch: the file's path changed after it was approved
• invalid encoding or replacement-character content in the source file

Why When an artifact publish fails, the message now says specifically whether the problem is a stale approval, a tampered or moved file, a missed check, or something else, instead of one generic "unverified" message, making it clearer what to do next.