refactor: fold org-template's action lifecycle + pendingPublish into one union (RD-13)

Before this change, org-template.store.ts held the action lifecycle in an
actionState signal and the publish impact-confirm gate in an independent
pendingPublish signal. The two were representable in combination, so
pendingPublish === true and busy === true could both hold at once. That
state was meaningless: the UI would show the publish-impact confirmation
while a publish was already in flight.

OrgTemplateState.Loaded now carries one action field, a four-variant union
(Idle | ConfirmingPublish | Busy | Failed). ActionStarted overwrites the
field straight to Busy from any prior tag, so ConfirmingPublish and Busy
can never coexist — not by convention, but because one field can only
hold one tag. requestPublish and cancelPublish become dispatches
(PublishRequested/PublishCancelled); as the reducer already no-ops
outside Loaded, this changes no behaviour. The other four commands
(confirmPublish, rollback, proefbrief, flushSave) keep their existing
loaded() guards. busy, lastError and pendingPublish stay on the store as
computed values reading the new union, with byte-identical public
signatures — no file under brief/ui/ changes.

Ran gen:behaviour-spec for the six new reducer cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/brief/domain/org-template.machine.ts

@@ -9,6 +9,13 @@ import { UploadMsg, UploadState, initialUpload, reduceUpload } from '@shared/dom
  * `dirty` tracks unsaved edits (the store debounce-saves them). The logo upload is
  * the composable upload sub-machine folded in, exactly like the wizards fold
  * `reduceUpload` — its `UploadComplete`/`UploadRemoved` also mutate `draft.logoDocumentId`.
+ *
+ * `action` (RD-13) owns the one-shot action lifecycle AND the publish impact-confirm
+ * gate as ONE four-variant union, replacing two independent store-level signals
+ * (`actionState` + `pendingPublish`). Before RD-13, `pendingPublish === true && busy
+ * === true` was representable and meaningless — the confirm dialog could show while a
+ * publish was already in flight. A single field with one tag at a time makes that
+ * combination unrepresentable.
  */
 
 /** The org-identity text fields editable directly on the letter canvas. */
@@ -21,6 +28,17 @@ export type OrgTemplateTextField =
   | 'signatureRole'
   | 'signatureClosing';
 
+/** The one-shot action lifecycle (publish/rollback/proefbrief), plus the publish
+    impact-confirm gate, owned by the reducer instead of two independent store-level
+    signals (RD-13). `ConfirmingPublish` is a variant of this SAME union, so
+    "confirming a publish while one is already in flight" is unrepresentable — no
+    state can ever carry both at once. */
+export type OrgTemplateActionState =
+  | { tag: 'Idle' }
+  | { tag: 'ConfirmingPublish' }
+  | { tag: 'Busy' }
+  | { tag: 'Failed'; error: string };
+
 export type OrgTemplateState =
   | { tag: 'Loading' }
   | { tag: 'Failed'; reason: string }
@@ -34,6 +52,7 @@ export type OrgTemplateState =
       dirty: boolean;
       /** Logo upload sub-state (single file, `org-logo` category). */
       upload: UploadState;
+      action: OrgTemplateActionState;
     };
 
 export const initial: OrgTemplateState = { tag: 'Loading' };
@@ -47,7 +66,12 @@ export type OrgTemplateMsg =
   /** Carries the draft that was saved: clears `dirty` only if no edit landed during
       the round-trip (reference-equal), so a concurrent edit keeps its pending save. */
   | { tag: 'DraftSaved'; savedDraft: OrgTemplate }
-  | { tag: 'Upload'; msg: UploadMsg };
+  | { tag: 'Upload'; msg: UploadMsg }
+  | { tag: 'PublishRequested' } // opens the publish impact-confirm gate
+  | { tag: 'PublishCancelled' } // closes it without publishing
+  | { tag: 'ActionStarted' } // a one-shot action (publish/rollback/proefbrief) began
+  | { tag: 'ActionFinished' } // it completed successfully
+  | { tag: 'ActionFailed'; error: string }; // it failed, carrying the message to show
 
 /** Edit the loaded draft; a no-op in any non-loaded state (illegal by construction). */
 function editDraft(s: OrgTemplateState, f: (draft: OrgTemplate) => OrgTemplate): OrgTemplateState {
@@ -72,6 +96,9 @@ export function reduce(s: OrgTemplateState, m: OrgTemplateMsg): OrgTemplateState
         // Keep the loaded logo category across sub-org switches (it's the same
         // `org-logo` category, loaded once); drop only any in-flight/finished uploads.
         upload: s.tag === 'Loaded' ? { ...s.upload, uploads: [], rejections: {} } : initialUpload,
+        // A fresh load clears a stale action error rather than letting it outlive
+        // the reload (RD-13, same as brief's RD-12).
+        action: { tag: 'Idle' },
       };
     case 'FieldEdited':
       return editDraft(s, (d) => ({ ...d, [m.field]: m.value }));
@@ -96,6 +123,22 @@ export function reduce(s: OrgTemplateState, m: OrgTemplateMsg): OrgTemplateState
       }
       return { ...s, upload };
     }
+
+    // The action lifecycle (RD-13): a no-op unless a template is loaded, since there
+    // is nothing to attach the action state to otherwise. `ConfirmingPublish` and
+    // `Busy` are variants of one field, so ActionStarted overwriting it to `Busy` is
+    // what makes the two mutually exclusive by construction — not by convention.
+    case 'PublishRequested':
+      return s.tag === 'Loaded' ? { ...s, action: { tag: 'ConfirmingPublish' } } : s;
+    case 'PublishCancelled':
+      return s.tag === 'Loaded' ? { ...s, action: { tag: 'Idle' } } : s;
+    case 'ActionStarted':
+      return s.tag === 'Loaded' ? { ...s, action: { tag: 'Busy' } } : s;
+    case 'ActionFinished':
+      return s.tag === 'Loaded' ? { ...s, action: { tag: 'Idle' } } : s;
+    case 'ActionFailed':
+      return s.tag === 'Loaded' ? { ...s, action: { tag: 'Failed', error: m.error } } : s;
+
     default:
       return assertNever(m);
   }