docs(publish): address review nits on the contract block

Four corrections from the review of #8, all in the files this PR already
touches:

- A local signal on the line that creates .publish-new-. The other four shapes
  each got a note at their producing line, which is the whole premise of #7 —
  someone renaming TMP_DST reads its own comment block and would never see the
  contract note 45 lines up at OLD.

- '.publish-old- is milder' understated it. Milder is true; bounded is not. A
  key whose branch is merged, deleted or renamed is never published again, so
  its rotated generation stays until something outside this repo takes it —
  which is the case gitdan#30 itself makes, two lines away.

- The drift check now says the prefix constants ci-cache-reclaim.sh DECLARES,
  not the ones it enumerates. Those are different numbers: collect_entries()
  globs .stage- and .evicting- only, because .reading- is read and never
  swept. Only the declared reading makes the five-against-five count work, and
  a countability check that needs a coin flip to count is not one.

- publish-snapshot.sh's own header had two stale names ten lines above the
  stale pointer this PR fixes: step 1 staged at .stage-<tag> (that is
  hardlink_clone_into's inner path; the staged snapshot is .publish-new-<tag>)
  and step 2 named .publish-old-<tag> without the key. Pre-existing and
  outside both ACs, but #6's thesis is that a plausible-looking wrong name is
  the worst kind, and these are in the file the PR is about.

Comments and docs only. With comments and blank lines stripped, all three
scripts hash identically to origin/main.

scripts/cache-lib.sh

@@ -32,7 +32,9 @@
 #                             its clone and the swap. Strands the same way.
 #   .publish-old-<key>-<tag>  publish-snapshot.sh: the rotated-away generation,
 #                             kept while a reader still holds it and swept by
-#                             the next publish of the same key.
+#                             the next publish of the same key — if there ever
+#                             is one. A merged or renamed branch never
+#                             publishes again, and its last one stays.
 #   .evicting-<name>-<pid>    prune-cache.sh, evict_dir(): a cache renamed
 #                             aside so the decision to unlink it can be retaken
 #                             after the rename. Swept at the start of every
@@ -63,9 +65,11 @@
 # precisely the shape only the arbiter can reach. Bringing both in is tracked
 # as daniel/gitdan#30.
 #
-# The two lists are meant to be the same length. A shape here without a prefix
-# there is one side having changed without telling the other, and it is
-# cheapest to notice by counting.
+# The two lists are meant to be the same length: the five names above, and the
+# prefix constants that script DECLARES — not the subset it enumerates as
+# reclaim candidates, which is smaller because `.reading-` is read and never
+# swept. A shape here without a constant there is one side having changed
+# without telling the other, and it is cheapest to notice by counting.
 #
 # The two staleness constants the arbiter mirrors are part of the same
 # contract, and that half has a direction to it — see CACHE_READ_STALE_SECONDS