refactor(publishing): delete 16 flat back-compat shims + retire-when-zero-consumers policy (DEPRECATION-SHIM-POLICY-1)

[docxology]

Change

Completes DEPRECATION-SHIM-POLICY-1 (Medium): retires the flat back-compat shim layer in infrastructure/publishing/ and documents the standing policy.

• 16 flat shims deleted (the row said 15; live-tree re-derivation found 16 — repository_metadata.py was uncounted): 11 metadata/release (metadata_export, metadata_export_cli, metadata_from_config, metadata_package, metadata_stage, repository_metadata, release_cli, release_pairing, release_receipts, release_workflow, release_workflow_zenodo) + 5 transmission (transmission_barcode_strip, transmission_bookends, transmission_figure, transmission_models, transmission_page_check). Historical import paths now fail fast with ModuleNotFoundError — clean cutover, no stubs.
• Consumers re-pointed: infrastructure/publishing/metadata/metadata_export_cli.py (import re-pointed at infrastructure.publishing.metadata.metadata_export) and infrastructure/publishing/arxiv/README.md (runnable snippet re-pointed at infrastructure.publishing.metadata.metadata_from_config). The row's other two "consumers" (tests/infra_tests/publishing/test_pypi.py, scripts/publish/test_pypi.py) import through the retained pypi_release surface — implementation home, not a shim — so they stay (row discrepancy documented in the policy section).
• Subprocess policy re-point: INTENTIONAL_SUBPROCESS_POLICIES release-rerender cited the deleted flat release_workflow.py; re-pointed at infrastructure/publishing/release/release_workflow.py (inventory binding test passes).
• Policy section added to infrastructure/publishing/AGENTS.md: retire-when-zero-consumers for the three retained surfaces (platforms.py, api.py re-export surfaces; pypi_release.py implementation home), the zero-consumer proof command, and the Backwards-compat shim docstring ban.

Verification

• uv run pytest tests/infra_tests/publishing/ -q → 869 passed (was 1 failed mid-change: the orphaned subprocess-policy source binding; fixed and re-proven).
• grep -rn "Backwards-compat shim" infrastructure/publishing/ --include='*.py' --include='*.md' → 0 hits (stale .pyc artifacts were the only residue; cleared).
• Old-path grep across infrastructure/ tests/ scripts/ for the deleted module paths (excluding their new homes) → 0 hits.
• uv run python scripts/docgen/counts.py --refresh-coverage-provenance --write → generator-owned provenance refreshed for the new file inventory.
• Full pre-commit battery green at commit (ruff CI scope, mypy --strict over 1,629 source files, staged-secret scan, skill-reachability).

Compatibility and failure boundaries

• Breaking for out-of-tree consumers of the 16 flat paths — same contract as the completed core-testing and metadata-publishing cutovers: import the real homes. The in-repo surface is fully migrated (0 old-path hits).
• No behavior change anywhere: shims were pure re-exports; the only semantic edit is the subprocess-policy source_path string.

Review checklist

• Changes preserve the infrastructure/project boundary and thin orchestrators.
• Tests use real implementations and comply with the repository no-mocks policy.
• Relevant lint, type, test, coverage, and security checks passed.
• Affected documentation and generated references match the implementation (AGENTS policy + provenance refresh).
• The staged diff contains only intended public files and no credentials or private artifacts.
• Deferred checks and known failures are explicitly documented (none).