[Publisher] Fix whitepaper CI: build script derived by deleting a hardcoded line range

[dp-web4]

What broke

The whitepaper build has been failing since this morning, so the 2026-08-27 content
corrections in dark_matter.md are in source but in none of the published surfaces.

build_whitepaper.yml derived its CI build scripts by deleting a hardcoded line range:

sed '6,29d' make-md.sh > make-md-ci.sh

That range was chosen to remove the git-sync block. The coverage guard added to
make-md.sh earlier today (itself a good fix, ported from web4) pushed the block down
by 17 lines, so the cut landed inside it — deleting the LOCAL= assignment while
keeping the test that reads it:

if [ $LOCAL = $REMOTE ]; then     # -> [ = <sha> ]  ->  unary operator expected

Both branches fell through to else, which reports a diverged branch and exits 1.

Run 33064599023:
make-md-ci.sh: line 9: [: =: unary operator expected (and line 11). Reproduced here
byte-for-byte, at both line numbers, before anything was changed.

The failure mode is worth naming: a hardcoded line range is an undeclared coupling
between a workflow and a script. Editing the script is what breaks it, and nothing
in the script says so.

The fix

The three build scripts now honour CI themselves and the workflow calls them
directly. .github/workflows/README.md already documented this contract
(CI=true bash make-md.sh, "CI-safe (skips git pull operations)") — no script had
ever implemented it, and the sed stood in for it. CI: true is already set at
workflow level, so nothing new is introduced.

Comparisons are now quoted, so an empty variable reports itself rather than raising a
unary-operator error. The dropped s/--toc-depth=3/--toc-depth=2/ substitution was
already inert — make-pdf.sh has read --toc-depth=2 at source for some time.

Second, unrelated defect found while testing

preprocess-proposals.sh and preprocess-sections.sh are mode 100644 in git, while
all three make-*.sh call them as ./preprocess-*.sh. All six invocations have been
failing Permission denied in every CI run — including green ones (see the 08-26
success, run 32960497165). An error printed, its exit status ignored, the build
reporting success.

Restoring the exec bit is currently a no-op, and that is measured rather than
assumed: 0 matching ### headers across the 50 files the preprocessor's own
find selects, against 68 ## headers as a positive control — so the instrument
works and the zero is real. Sources are already in the demoted form that 515f6cc6
(2025-08-22) converted them to. This re-arms the safety net for the next ### header
somebody writes; it does not change current output.

Worth flagging for a maintainer: these preprocessors rewrite section sources in
place. That is by design, and the deploy step is scoped (git add docs/ whitepaper/build/) so a runner's mutations never reach main — but it is the reason
this was checked carefully rather than just chmod'd.

Verification — the runner's own invocation, in an isolated worktree

Arm	Result
CI=true (as the runner runs it)	"CI detected: skipping git sync"; make-md.sh, make-pdf.sh, make-web-clean.sh all exit 0; 0 Permission denied
CI unset	"Checking for updates… / Already up to date." — sync still runs, exit 0
Wrong cwd, CI=true	cwd coverage guard still exits 1, creates no stray build/

git status on whitepaper/sections/ after a full build: empty — confirming the
re-enabled preprocessing mutates nothing.

The rebuilt monolith carries today's corrections (CORRECTED 2026-08-27 ×4,
factor 5.6 spread ×2, 0.045 and 0.065 ×3) and differs from the committed artifact
by 21 lines — the correction and nothing else.

Artifacts are deliberately not committed here: CI is the authoritative builder in
this repo and deploys on merge, so landing this closes the propagation gap through the
normal path with one producer rather than two.

Note on the diff

build_whitepaper.yml is a pure-CRLF file (192/192 at HEAD). The first attempt wrote
it back as LF and turned a 20-line change into a 367-line whole-file reformat; it was
redone preserving line endings. The diff here is only the edit.