Publish current labels

Publishes an immutable snapshot of entity, product, and vault-label content. Geo policies remain live and are not included. The snapshot builder decides per row where the content comes from: a full publish takes every draft row that no hold covers and keeps held rows at their published content; a partial publish (selection in the body, platform session only) takes the selected rows and whatever they need for a consistent version, overriding holds for those rows, and keeps everything else as published. Left-out changes stay pending. A draft vault row with no labels (the row discovery materialises for every vault it finds, a claim cleared) is not label content: no publication takes it, a selection naming one is a no-op, and the report.leftOut says how many such rows the draft holds and which the selection named. The report also lists what went live, what was pulled in, what a hold kept back and why, and which holds were overridden. ?dryRun=true returns the report without writing anything. When the built content matches the latest published version, the endpoint returns that version with publishOutcome: unchanged and does not create a release. Accepts a platform session or an API key holding the labels:publish capability; a key may only publish in full. The version records which kind of actor published it, and every publication is audited. To publish exactly what a dry run showed, send its draftToken as expectedDraftToken: if the draft, the latest version or the holds a partial publish would override moved since, the answer is 412 with details.reason draft-changed and the current details.draftToken, and nothing is written. Without the field, the publish takes the draft as it is at that moment; it will become required for keys, and a key publish without it is logged.