fix(push): retain publisher identity through final cleanup

[LucaLin233]

Summary / root cause

Retain ACTIVE_WORKER_STATE_FILES and ACTIVE_WORKER_STATE_STARTS after successful active-only cleanup. The accepted worker is still live and may publish again. Dropping its maps prematurely prevents final post-reap cleanup from finding republished state, while runtime_cleanup_final_proof correctly refuses runtime deletion.

Scope

Two files only: tools/push.sh and tests/test-push-worker-registration.sh. Based on main aa99013. HEAD ca0865a. No changes to signal status, grace periods, parsing trust, final proof, or directory deletion policy. No #41 changes.

Validation

Deterministic fixture performs active cleanup -> republish -> worker no longer active -> final cleanup, verifies maps retained and final cleanup executes twice. Old implementation necessarily fails the retained-map assertion. Existing live publication/signal tests unchanged. Both Ubuntu and Debian passed push and worker-registration suites, full=false, including cleanup_failed/stage-ready/TERM and all original residue assertions.
CI: https://github.com/LucaLin233/Linux/actions/runs/34235744864
Original failure: https://github.com/LucaLin233/Linux/actions/runs/34233845075
Local bash -n for both changed files and git diff --check passed. Behavioral tests run only in CI without real credentials.

Second-pass review / remaining risk

Review PASS for the tracking fix. prune_active_workers removes absent-file maps only after wait/reap; cleanup_published_worker_sessions preserves trust checks and handles existing republished state after reap. Temporary .worker-session.*.tmp is not itself the final-proof blocker: runtime_has_published_worker_state checks published *.state, not publication temps. Once published state and lifecycle evidence resolve, existing dev/inode-verified runtime deletion removes leftover temporary files. Thus no new wildcard deletion or separate stage cleanup is introduced. Source supports this explanation, but the precise original race interleaving was not instruction-traced. Deterministic reproduction uses stubs; live matrix is finite and not production E2E.

Rollback / delivery

Revert the squash commit if merged. No production config, SSH, APT or services operated. No credentials supplied to tests. Same-assistant second-pass review, not third-party review. Draft remains pending explicit user authorization to mark Ready, Squash merge and delete branch. #47 remains blocked until this fix is merged and synchronized, then its full CI must run again.