chore: file the advisory-publication intent and its schema-field issue

[REPPL]

Records only, no code. Held for the release-cutting session's ordering ruling; not armed for the queue.

• itd-2609151658486398 (draft): a release cut publishes the security advisories its fixes close, and closes those whose record was resolved as won't-fix. This is the publication step the 2026-08-27 advisory-handling pilot named as its target; routed as an intent at an interactive question.
• iss-2609151703088754 (open): a security record names its advisory only in its slug and prose, so nothing can match a resolved record to the advisory it fixes; a typed advisory: field is the half split out of the intent so it can land first.
• Two entries in the decomposition-calibration note grading today's hand-runs (the interview-context intent and this one).

Context: GHSA-gx3m-3224-qqcv was fixed in v0.8.0 and still an unpublished draft; published by hand today at the maintainer's word. GHSA-6xpc is closed as won't-fix in #634. GHSA-4q78's fix is in progress on its own branch.

Gates: record-lint, lint-issues and docs-lint green.

Refs: iss-2609151703088754
Assisted-by: Claude:claude-fable-5-1