Add publishing routing-strategy shim to phoenix_kit_routes/0

[mdon]

Summary

Pairs with BeamLabEU/phoenix_kit_publishing#14.

phoenix_kit_routes/0 now emits a publishing-specific dispatch shim
when PhoenixKitPublishing.RouterDispatch is loaded:

• an internal-prefix scope at
  /<url_prefix>/__phoenix_kit_publishing_dispatch with two sub-scopes
  (/localized binding :language + :group, /root binding
  :group only), each piped through the standard :browser +
  :phoenix_kit_* pipelines plus a new :phoenix_kit_publishing_internal
  pipeline that runs RouterDispatch.restore_path/2;
• a def call/2 override on the host router (Phoenix.Router publishes
  defoverridable init: 1, call: 2 from match_dispatch/0 — a
  documented extension point) that calls RouterDispatch.maybe_rewrite/1
  before super(conn, opts). Publishing-bound URLs get path-rewritten
  onto the internal prefix and dispatched via Phoenix's normal
  pipeline; URLs that don't resolve to a known publishing group pass
  through unchanged so host routes win Phoenix's first-match.

Compile-time gated on
Code.ensure_loaded?(PhoenixKitPublishing.RouterDispatch). Installs
that don't have publishing in the dep tree get an empty AST — no
behaviour change.

Why

Publishing's old Routes.public_routes/1 registered
/:language/:group(/*path) and /:group(/*path) directly under the
host's URL prefix. Under url_prefix: "/" those routes match every
two-or-more-segment URL, and Phoenix.Router has no per-segment regex
constraint mechanism — so any host route declared after
phoenix_kit_routes() shaped /:locale/<literal>/... was silently
shadowed: publishing's controller matched first, didn't find the
group, returned 404. Canary host's
/fr/services/view/nos-services-a-nice (and three other
/:locale/services/... routes) were dead this way after they
installed phoenix_kit_legal (which transitively pulls publishing).

The dispatch shim flips the trust direction. Publishing's catch-all
no longer sits at the host's absolute root claiming everything;
instead the override checks each request against the listing-cache /
DB and rewrites only when the URL belongs to a known publishing
group. Host routes get a fair shot at every URL.

See BeamLabEU/phoenix_kit_publishing#14 for the matching
PhoenixKitPublishing.RouterDispatch module, the policy details
(maybe_rewrite/1, restore_path/2, the defoverridable edge case
for hosts with their own def call/2), and the 19-test pinning suite.

Coordination notice

This change is conditional on PhoenixKitPublishing.RouterDispatch
being present, so:

• Hosts running this core change with an older publishing version (no
  RouterDispatch module) — Code.ensure_loaded? returns false, the
  helper emits no-op AST, publishing's old Routes.public_routes/1
  still registers the catch-all as before. Behaviour unchanged.
• Hosts running this core change with the new publishing version
  (RouterDispatch present, Routes.public_routes/1 returns no-op) —
  the macro emits the override + internal scope. Bug fixed.
• Hosts running the new publishing version with an older core (no
  macro change) — publishing's Routes.public_routes/1 no longer
  registers the catch-all and the override isn't emitted, so
  publishing public URLs return Phoenix NoRouteError.
  Regression for them — so the publishing PR shouldn't ship to
  Hex without this core release also being out.

Both versions need to ship together (or core ships first, then
publishing). The publishing PR description flags the same constraint
in the other direction.

Verification

mix format --check-formatted # clean
mix credo --strict # clean (one nit fixed during the sweep)
mix test # 1055 tests, 4 failures (all pre-existing — V107
migration tests + a permissions test, unrelated
to this change; verified by stashing the diff
and re-running)

Browser smoke (workbench phoenix_kit_parent setup with the canary
collision shape — url_prefix: "/" + /:locale scope after
phoenix_kit_routes()):

URL	Result
/en/services/view/test-slug	200 — host's ServicesLive (was 404 pre-fix)
/fr/services/view/x	200 — multi-locale
/en/db-test-1/markdown-rendering-demo	200 → canonical /db-test-1/..., body shows post
/db-test-1/markdown-rendering-demo	200 — canonical works directly
/ku-ku/the-new-post	302 — group listing fallback (regex-collision regression closed)
/admin/dashboard	302 → log-in (admin still routes)
/	200 — host home
/some-unknown-route	404 — genuine Phoenix NoRoute, not publishing's smart-fallback

document.documentElement.outerHTML.includes('__phoenix_kit_publishing_dispatch')
returned false on every rendered publishing page checked. Zero leakage
of the internal prefix or either discriminator segment in canonical, og,
links, JS, headers.

Canary install (separate host, four-locale config, three publishing
groups including ku-ku slug-mode) verified the same matrix
end-to-end + session/CSRF + view-source — all green after both
commits land.

Test plan

• mix precommit clean
• All publishing test suite (1018 tests, 0 failures) passes against the new macro shape via the matching publishing PR
• Browser smoke covers the eight URL classes in the matrix above
• HTML body sweep for prefix / localized / root segment leakage — 0 occurrences
• Canary install pins both branches via git deps and re-ran the full matrix — all green
• Pre-existing 4 test failures verified unrelated by stash-and-rerun

Files

• lib/phoenix_kit_web/integration.ex (+94 lines: compile_publishing_routing/1 private helper + splice point in phoenix_kit_routes/0)
• AGENTS.md (+44 lines: "Publishing routing strategy" section under "External module route discovery")