Made of little things.

# Historical public backend context blocks publication (soyLI 0.23.1)

Napcraft's current source, backend, screenshots, clip and hosted checks pass.
Actual publication fails after `Publishing: sandbox`, at `Publishing: freeze`:

```text
SOURCE_SECRET: The source selection contains a private or generated file.
Remove it from publish.files.
```

`soyli status --json` returns `{"status":"not_started"}`. No frontend release was
published. A preceding backend deployment attempt returned `RUNTIME_FAILED` with
HTTP 404 for the uncreated public GRASP repository and left the active release
unchanged. That dependency error is expected until source publication succeeds.

## Confirmed cause

The installed CLI's freeze step validates **all reachable Git blobs** using
`git rev-list --objects <commit>`, not only the current selected source. Its path
validator rejects every `.napplet-space` component. Inspection found exactly one
such reachable blob in this repository:

- Path: `.napplet-space/soy-backend.json`
- Object: `da5a170b5817cd421609301436adc0acb94235c2`
- Added by `871d25a`; removed by `368abc2`.
- It contains public generated fields: `version`, `provider` (`pubkey`, `relays`),
  `napplet`, `boards`, `modules`. This was the public context that the old guidance
  told authors to retain. It is not a creator credential or local world database.

The file is currently ignored and absent from `git ls-files`. The current tree
has no blocked paths. The CLI update and skills update correctly preserve Git
history, so neither can remove the historical blob. The 0.23.1 backend-copy bug
fix allowed publication to reach this later check; this is not evidence that
0.23.1 introduced the history rule.

## Reproduce safely

```sh
soyli --version
soyli check                    # succeeds
soyli publish --dry-run        # current-file plan succeeds
soyli publish                  # SOURCE_SECRET at freeze
soyli status --json            # not_started
git log --all --oneline -- .napplet-space/soy-backend.json
git rev-list --objects HEAD    # historical public-context blob remains reachable
```

No need to print blob contents to report the failure. The object/path identify it.

## Suggested tooling follow-up

1. Run the history validation during dry-run and identify the rejected path and
   history object/commit. The current advice to edit `publish.files` cannot fix a
   blob that exists only in commit ancestry.
2. Provide a documented, explicit migration for projects created with the old
   public-context guidance. Options include an author-approved, backed-up history
   cleanup, or a narrowly validated migration for this exact historical public
   metadata format while retaining content/credential checks.
3. Never broadly exempt `.napplet-space`: it also contains private bindings,
   journals and databases. Do not disable the secret scanner or silently rewrite
   the author's Git history.
4. Add a regression fixture that historically tracks the old public context,
   removes it from HEAD, upgrades guidance, and attempts publication. Assert an
   actionable migration diagnostic (or the chosen supported migration behavior).

The workspace history has been preserved. The responsive game changes are
committed; this remaining publication issue needs an explicit history decision
or the corresponding tooling migration before the existing publish/deploy flow
can finish.