[Core] Make post-load publication warm-only

Close publication leases inside Host Weight Runtime, return only the publication report, and cover the new terminal mappings. Rename the runtime test module to avoid the pytest basename collision reported in #6436.

Signed-off-by: Hongsheng Liu <liuhongsheng4@huawei.com>

docs/design/feature/host_weight_runtime.md

@@ -86,7 +86,9 @@ flowchart TD
     P -->|"nonretryable failure"| E
     C --> W{"Post-load publication enabled?"}
     W -->|"yes"| B2["Publish final model through POST_LOAD_ONLY producer"]
-    B2 --> R2["Return separate report and optional lease"]
+    B2 --> CL["Close validated publication lease"]
+    CL --> R2["Return separate publication report"]
+    R2 --> D
     W -->|"no"| D["Keep canonical model"]
 ```
 
@@ -144,12 +146,8 @@ sequenceDiagram
             L->>R: publish_after_load(identity, POST_LOAD_ONLY producer)
             R->>S: get_or_build(identity, producer)
             S-->>R: validated HostWeightLease or typed failure
-            R-->>L: separate publication report and optional lease
-            opt consume mmap in current startup
-                L->>X: plan_restore(model, lease)
-                X-->>L: validation-only restore plan
-                L->>X: commit() once
-            end
+            R->>R: close publication lease
+            R-->>L: separate publication report
         end
     else required or nonretryable failure
         R-->>L: FAILED report
@@ -167,9 +165,9 @@ must be discarded and canonical fallback must construct a fresh model.
 `publish_after_load()` is synchronous in V1 and accepts only a
 `POST_LOAD_ONLY` producer. Its report is separate from the terminal resolution,
 so a publication failure cannot rewrite a successful canonical fallback. A
-successful publication transfers a lease to the caller. The loader may close
-that lease after warming future startups, or restore from it before the model
-enters service to replace private host allocations with shared mmap backing.
+successful publication closes the store-returned lease inside the runtime and
+warms only future startups. It does not restore, rebind, or otherwise mutate the
+canonically loaded model serving the current startup.
 `allow_local_build` gates producers during pre-load resolution, while
 `allow_post_load_publish` independently gates this explicit post-load path.
 

docs/design/module/host_weight_runtime.md

@@ -150,11 +150,10 @@ only after the canonical loader has established the current model.
 Post-load publication is synchronous in V1, but its outcome is independent of
 the already completed resolution. A store failure is returned in a separate
 publication report and cannot turn a valid canonical model into a failed
-resolution. On success, ownership of the validated lease transfers to the
-caller. The caller may close it after warming the store, or use a restorer to
-rebind a model that has not entered service so the current process can also use
-the shared mmap backing. Model mutation and lease teardown remain loader and
-transport responsibilities.
+resolution. On success, the runtime closes the validated store lease before
+returning the report. Post-load publication only warms future startups; it does
+not restore, rebind, or otherwise mutate the canonically loaded model serving
+the current startup.
 
 ## Restoration transaction boundary