Support three protected manual IBKR facts publication targets

[Pigbibi]

Change

Add three fixed manual targets to the existing single-report publisher. Each selected target is resolved from protected configuration, with strict identity, destination, prefix and primary-account duplicate checks. The existing default scheduled target remains unchanged.

Prepare only the two project variables before cloud authentication, mask their values, and preserve primary identity settings for the second process. The publisher keeps the existing complete report/source/revision/native identity and freshness checks and sends at most one POST. Exact-report manual publication skips unrelated heartbeat work.

Validation

• Author: 87 directional publisher, heartbeat and workflow tests passed.
• Root: 84 publisher and heartbeat tests passed, including separate preparation and publisher processes through the actual environment file contract.
• ruff, actionlint, compile and diff checks passed.
• Independent material review: bounded PASS.

No additional sampling, schedule changes, trading activation or new credentials/IAM. Protected configuration and real publication are verified separately.