fix(publish): rich republish keeps the listing's categories, license and source_url

[TeoSlayer]

Problem

scripts/publish-rich-from-r2.sh builds the catalogue entry for a rich submission from its top-level .categories, .license, .source_url and .display_name. All 18 rich submissions in submissions/ keep those fields under .listing instead:

$ for f in submissions/*/submission.json; do jq -r '...' $f; done
io.pilot.plainweb top_cat=false listing_cat=true top_lic=false listing_lic=true
... (the same for all 18 rich submissions)

So the script falls back to categories: [], license: "" and the app-template submission path for source_url. The next republish of any rich app would replace those fields in its live catalogue entry.

Found while preparing io.pilot.plainweb 1.0.1 (the build with the lifecycle fixes from #111). A DRY_RUN=1 of the script against the candidate 1.0.1 bundles, served from a local fake R2, gives:

field	live 1.0.0 entry	dry run on main	dry run with this PR
categories	["web","content","markdown"]	[]	["web","content","markdown"]
license	Proprietary	""	Proprietary
source_url	https://github.com/pilot-protocol/plainweb	https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.plainweb	https://github.com/pilot-protocol/plainweb

Fix

Each of the four fields now falls back to .listing.<field>. A top-level field, where one is set, still wins. The same variables feed the metadata.json the script generates for an app that doesn't have one yet, so that output is fixed too.

Tests

TestPublishRichFromR2ReadsListingFields (internal/publish) runs the real script in DRY_RUN against an httptest fake R2 serving a minimal bundle, then checks the entry it prints. It has two cases: fields only under .listing, and a top-level field overriding the listing. It skips if bash, jq, curl, shasum or tar is missing.

• On main, both cases fail: entry.categories = [], entry.license = "", entry.source_url = ".../app-template/tree/main/submissions/io.pilot.listingx", entry.display_name = "Listingx".
• With this PR, both pass on macOS arm64 and in golang:1.25.13-bookworm linux/arm64 (jq 1.6).
• go vet ./... and go test ./... pass on macOS.

🤖 Generated with Claude Code