#1043 Stopgap for #945/#1006: only the platform tenant may publish app versions, and only platform-published versions execute

EARS SPEC: - If a tenant other than platform calls POST /api/v1/apps (create with its own publisher), POST /api/v1/apps/<id>/versions, or POST /api/v1/apps/<id>/versions/<vid>/publish, then the API shall return 403 with code APP_PUBLISHING_RESTRICTED and shall write nothing. - If a workflow task resolves an app action whose version was published by a publisher other than platform, then the engine shall refuse to load or execute the source, fail the task with a non-retryable APP_PUBLISHER_NOT_ALLOWED error, and log the app, version and tenant. - Installing and running platform-published apps from any tenant shall keep working (welcome_email etc.). - The allowed publisher set shall be one platform-config value ([apps] allowed_publishers, default 'platform'), read at startup; an empty value shall mean no app executes, never all apps. Reason: app source runs in a forked child of the worker with the worker's uid, environment and file access (#945, #1006), so any tenant publisher can read platform secrets. This closes the path until app isolation is redesigned (RunFlow-based or a dedicated runner, in the per-component review the owner scheduled). Owner approved 2026-10-22.