fix(tenant): finalize definitive/manual-retry publish tasks as failed

Add normalizeDesktopTaskCompletionStatusForTask so an "unknown" publish
completion is downgraded to "failed" when the payload is a manual retry or
the error matches a definitive publish failure, instead of leaving it
stuck as unknown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/desktop_task_service_test.go

@@ -204,6 +204,40 @@ func TestNormalizeDesktopTaskCompletionStatusForKindFailsMonitorUnknown(t *testi
 	}
 }
 
+func TestNormalizeDesktopTaskCompletionStatusForTaskFailsDefinitivePublishUnknown(t *testing.T) {
+	t.Parallel()
+
+	got := normalizeDesktopTaskCompletionStatusForTask(
+		"publish",
+		"unknown",
+		nil,
+		[]byte(`{"publish_submit_uncertain":true,"code":"toutiaohao_publish_failed","message":"标题长度应该在2-30字之间"}`),
+	)
+	if got != "failed" {
+		t.Fatalf("publish title validation completion status = %q, want failed", got)
+	}
+
+	got = normalizeDesktopTaskCompletionStatusForTask(
+		"publish",
+		"unknown",
+		nil,
+		[]byte(`{"publish_submit_uncertain":true,"message":"network interrupted after submit"}`),
+	)
+	if got != "unknown" {
+		t.Fatalf("ambiguous publish completion status = %q, want unknown", got)
+	}
+
+	got = normalizeDesktopTaskCompletionStatusForTask(
+		"publish",
+		"unknown",
+		[]byte(`{"manual_retry":true}`),
+		[]byte(`{"publish_submit_uncertain":true,"message":"network interrupted after submit"}`),
+	)
+	if got != "failed" {
+		t.Fatalf("manual retry publish completion status = %q, want failed", got)
+	}
+}
+
 func TestExpiredMonitorDesktopTasksCandidateSQLSelectsOnlyExpiredInProgressMonitorTasks(t *testing.T) {
 	t.Parallel()