Function publish 

pub fn publish(
    repo: &Path,
    project_state: &Path,
    feature: &str,
    tmp: &Path,
) -> Result<Option<String>, String>

Publishes a finished feature’s held-out sets: one commit, parented on the feature branch’s tip, with <task>/manifest.json and <task>/files/… of every task, under refs/speccoder/held-out/<feature>. Only once the feature is done — earlier, a later task could read them. Never pushed by speccoder itself. Ok(None) when no task has a set.