fix(ghost): guard anti-duplicados dentro de publish_draft, solo tras POST aceptado

El guard anterior vivía en el fallback de autofill y casaba con CUALQUIER
draft del mismo título: un fallo pre-POST (Ollama caído) con un draft viejo
del mismo topic descartaba en silencio el contenido recién generado.

Ahora la recuperación vive dentro de publish_draft y solo se activa cuando
el POST fue aceptado (2xx) y falla la lectura de la respuesta — el escenario
exacto del incidente br del 2026-07-04 — con filtro since=attempt_start en
find_draft_by_title. Cubre a todos los callers: autofill, bare publish y
/publish (antes sin proteger: reintento del usuario = draft duplicado).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

KNOWN-ISSUES.md

@@ -14,12 +14,18 @@ project-wide: Ghost/Cloudflare responded in brotli, the decode blew up AFTER
 Ghost had already accepted the POST, and the publish fallback re-published →
 duplicate drafts + silently lost SEO notices.
 
-Fix applied (commits `397546a` + `76c927f` + `7d07375`):
+Fix applied (commits `397546a` + `76c927f` + `7d07375`, guard relocated
+2026-07-05):
 - no brotli backend in requirements.txt (comment there explains why),
 - explicit `Accept-Encoding: gzip, deflate` on all Ghost/autofill aiohttp
   sessions and on the scraper HEADERS (`57f341f`),
-- duplicate guard in `_publish_blog_to_ghost`: on fallback-after-exception it
-  checks `find_draft_by_title()` before re-publishing.
+- duplicate guard INSIDE `GhostPublisher.publish_draft` (covers every caller,
+  including `/publish`): if the POST is accepted (2xx) but reading the response
+  fails, it recovers the just-created draft via `find_draft_by_title(title,
+  since=attempt_start)` instead of raising. The guard only fires after an
+  accepted POST — a pre-POST failure (Ollama down, menu fetch, links) never
+  triggers it, so a stale same-title draft from a previous run can no longer
+  swallow freshly generated content.
 
 Re-test with disclosure.org before ever re-enabling br (e.g. after an aiohttp
 upgrade).