gleamunison/cli_publish
gleamunison publish <file.lisp> — the evidence turnstile as a command.
Every term definition in the file must carry a passing Test attestation
on its content hash (put there by gleamunison test). Refusal lists
exactly the unevidenced definitions; success merges the defs into
.gleamunison/published as name → hash lines. The hash is the identity:
re-publishing a def replaces its old entry.