Add the --publish switch: clean-by-default (config + notes), gate blocktrails.json / .well-known behind opt-in

[melvincarvalho]

Implements the mode split defined in FUNDING.md (#43). Right now the contract promises clean-by-default but the code does publish-always — this closes that gap.

Current behaviour (publish-always, hardcoded)

git mark writes blocktrails.json into the working tree on every mark — there's no way to anchor a repo without leaving anchor files in it. The contract says that should be the opt-in, not the default.

Proposed

• Default = clean. A mark updates only git config (gitmark.txo) + git notes. Nothing is written into the working tree.
• --publish / --in-repo (opt-in) also serializes the trail to blocktrails.json (and, where relevant, .well-known/txo/txo.json).
• git mark update already serializes blocktrails.json from notes — it is effectively "publish on demand," so the flag can reuse that path.

Why it's safe / not lossy

git notes push to refs/notes/*, so the trail still travels with the repo and git mark verify still works without any committed file. blocktrails.json is a serialization of what's already in notes, not the source of truth — so making it opt-in loses nothing.

Notes

• A published site (e.g. a gh-pages repo) just passes --publish; an ordinary code repo being timestamped stays clean.
• Producer side mirrors this: blocktrails/fund-agent gating .well-known/txo/txo.json behind the same flag — see that repo's companion issue.
• Contract: Define the funding & state contract: clean-by-default, two roles (nostr.voucher bootstrap → gitmark.txo tip) #43 / FUNDING.md. Feature-scope (changes default behaviour) — sequence deliberately.