The serve path behind the first-party publish route: PUT /{pkg}.

This module handles the publish flow: it validates edge authentication, applies anti-shadowing scope guards to ensure the package name is permitted for publication, bounds the request body at the per-request size cap (a declared over-cap length fails closed up front; a chunked body is bounded by a counted read, both answered 413), enforces body-name agreement between the URL path and the publish document, and relays the request to the upstream publication target with the publisher's credential.