Controller refresh rejects an authenticated prepared temporary snapshot publication

A crash after a refreshed execution snapshot temporary tree is fully written but before its atomic rename leaves an authenticated prepared journal entry alongside the matching temporary publication. An authorized refresh resume currently validates the snapshot root before reconciling that exact temporary publication and fails closed instead of safely removing it and rebuilding.\n\nAcceptance criteria:\n- During explicit controller-refresh recovery, reconcile only temporary publication names matching the single authenticated prepared generation.\n- Keep unrelated generations, final directories, malformed names, and symlinks fail-closed.\n- Add a regression for the abrupt-exit filesystem state and preserve the existing published-final recovery.

Start with the controller-refresh recovery path that validates the snapshot root, then trace how authenticated prepared journal entries and temporary publication names are reconciled. Reproduce the abrupt-exit state where the temporary tree is complete but not atomically renamed. Done means the matching temporary publication is safely rebuilt only for the authenticated generation, while unrelated, malformed, final, and symlink entries remain fail-closed and published-final recovery still passes.