[BUG] QoS 2 PUBLISH answered with PUBACK instead of PUBREC

- severity: Medium
- files: `shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/Publish.java:97-103`
- description: `qos2()` builds a `MqttPubAckMessage` with fixed-header type `PUBACK`. For QoS 2 PUBLISH the server must answer with PUBREC, then complete PUBREL/PUBCOMP. Sending PUBACK terminates the QoS 2 handshake incorrectly.
- impact: QoS 2 (exactly-once) delivery is broken; spec-compliant clients treat it as a protocol error.
- suggested_fix: Send PUBREC for QoS 2 and implement the PUBREL→PUBCOMP half-handshake.
- confidence: High
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._