fix: publish account facts independently on existing schedule

[Pigbibi]

Summary

• Run the existing account-facts publisher independently on the existing daily schedule.
• Move account and deployment mapping out of public workflow/source into protected Secrets.
• Preserve original observation time and the 36-hour freshness guard.
• Distinguish unchanged observations from new observations using strict receiver response semantics.

Validation

• Publisher: 31 synthetic targeted tests passed.
• actionlint, compile and diff check passed.
• Independent static review passed.

This patch does not query brokers, change trading authorization or alter trading schedules. Report producer adoption and a matching source-binding rotation are still required before natural reports can refresh the homepage; missing or mismatched reports fail closed. Two natural publication cycles remain to be accepted.