buildsuites publish riders: librev default -> 2 (published-state record) + record path fix

librev defaults bumped 1->2 in both recipes with repaired help text (was
"nothing published yet" while r1 had been published since 2026-07-30 - the
manual-drift failure mode recorded in G-171's publish follow-on); the help
now states the convention: the default IS the committed record of published
state, bumped in the same work unit as each publish. Family-record comment
fix (tcl90): the repairs-manifest pointer is artifact-relative -
lib/tcllib<ver>/punkbin-upstream-repairs.toml in the mounted image (the
attached zip roots at the staged base/, so the previous base/lib/... path
named a location that does not exist to a reader inside the runtime).
Probe-caught before publish; family kits rebuild before the replace.

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

src/buildsuites/suite_tcl86/build86.zig

@@ -898,7 +898,7 @@ pub fn build(b: *std.Build) !void {
         //are not bit-reproducible across zig rebuilds). Publication to the real
         //punkbin repo stays a deliberate user step.
         const library_artifacts_step = b.step("library-artifacts", "emit punkbin lib-tier artifacts (<pkg>-tcl8-r<N>.zip + toml + sha1sums) from the verified tcllib/tcllibc installs -> <prefix>/library/punkbin/lib");
-        const librev = b.option(u32, "librev", "assembly revision N for the -r<N> library artifact names (library-artifacts; default 1 - nothing published yet)") orelse 1;
+        const librev = b.option(u32, "librev", "assembly revision N for the -r<N> library artifact names (library-artifacts; default 2 - r2 published 2026-08-08 with the pkgindex_gate repairs manifest, r1 2026-07-30). The default IS the committed record of published state - bump it in the same work unit as each publish.") orelse 2;
         const punkzip_exe = b.addExecutable(.{
             .name = "punkzip",
             .root_module = b.createModule(.{

src/buildsuites/suite_tcl90/build905.zig

@@ -2626,8 +2626,8 @@ pub fn build(b: *std.Build) !void {
                     \\cpu_model = "{s}"
                     \\{s}
                     \\#tcllib_checkout names the SOURCE checkout; the shipped tcllib tree is that
-                    \\#checkout PLUS the pkgIndex repairs enumerated in this kit's
-                    \\#base/lib/tcllib{s}/punkbin-upstream-repairs.toml (pkgindex_gate output -
+                    \\#checkout PLUS the pkgIndex repairs enumerated in this artifact's attached
+                    \\#image at lib/tcllib{s}/punkbin-upstream-repairs.toml (pkgindex_gate output -
                     \\#complete by construction: the gate fails the build on any unrecorded
                     \\#divergence, in both directions).
                     \\tcllib_gated = true
@@ -2742,7 +2742,7 @@ pub fn build(b: *std.Build) !void {
             //attached tcllib/tcllibc hash the very zips being published).
             //Publication to the real punkbin repo stays a deliberate user step.
             const library_artifacts_step = b.step("library-artifacts", "emit punkbin lib-tier artifacts (<pkg>-tcl9-r<N>.zip + toml + sha1sums) from the verified tcllib/tcllibc installs incl. the linux-x86_64 cross build -> <prefix>/library/punkbin/lib");
-            const librev = b.option(u32, "librev", "assembly revision N for the -r<N> library artifact names (library-artifacts; default 1 - nothing published yet)") orelse 1;
+            const librev = b.option(u32, "librev", "assembly revision N for the -r<N> library artifact names (library-artifacts; default 2 - r2 published 2026-08-08 with the pkgindex_gate repairs manifest, r1 2026-07-30). The default IS the committed record of published state - bump it in the same work unit as each publish.") orelse 2;
             //punkzip: staged upstream checkout (sources.config 'punkzip' record /
             //build.zig.zon pin), compiled for the build host - a build tool, not a
             //target artifact. ReleaseSafe deliberately: it does real deflate work