fix: stamp store_meta generation on every publish, not never

[pranitpanda-affirm]

What does this PR do?

trace_path's pagination cursor logic refuses to ever mint a cursor once a project's store generation reads "legacy" — and every project indexed through the normal index_repository flow was stuck there permanently, silently capping caller-enumeration results with no way to page past them.

Root cause: cbm_pipeline_publish_staged only ever read the project row (for coverage metadata) but never wrote it. The byte-level writer (sqlite_writer.c) hand-builds the projects table row directly on every publish, bypassing cbm_store_upsert_project — the only function that creates store_meta (db_uid/mutation_gen).

Fix: call cbm_store_upsert_project on every full and incremental publish, re-reading the project row afterward so coverage metadata reflects the freshly-stamped generation. store_meta now gets created on a project's first publish, and mutation_gen advances on every subsequent one — correctly invalidating cursors minted against a prior generation.

Caveat: this only takes effect going forward. A project whose files haven't changed since its last index hits the incremental.noop fast path (pipeline_incremental.c) and skips publish entirely by design — it can't retroactively escape "legacy" without either a real content change or a forced full rebuild (delete + reindex).

Testing

New pipeline_publish_escapes_legacy_generation test in tests/test_pipeline.c: verifies a fresh index escapes "legacy", and a second real publish (after an actual file edit, to avoid the no-op fast path) advances the generation further.

Also verified directly against the installed production binary and live daemon (not just the test build): indexed a throwaway repo fresh — store_meta appeared immediately with mutation_gen=1; made a real edit and reindexed — mutation_gen advanced to 2 and indexed_at refreshed.

Checklist

• Every commit is signed off (git commit -s) — not yet done, flagging for follow-up
• Tests pass locally (make -f Makefile.cbm test) — relevant suites (pipeline, store_*, mcp, graph_buffer) are clean; the full run has ~327 pre-existing failures in tree-sitter grammar/extraction probes, unrelated to this change and present on main before it
• Lint passes (make -f Makefile.cbm lint-ci) — not run locally (cppcheck/clang-format unavailable in this environment); deferring to CI
• New behavior is covered by a test (reproduce-first for bug fixes)