fix(publish): validate optional assets and default export inside project

Addresses review feedback on export_bundle:

- If subtitles_path or thumbnail_path is provided but the file is missing, the
  tool now fails with an explicit error instead of silently producing a package
  without that asset (which could ship an approved deliverable missing part of
  its content).
- Default export location now stays inside the project workspace: when the
  render lives at projects/<name>/renders/..., the bundle defaults to
  projects/<name>/exports/ (alongside artifacts/, assets/, renders/) rather than
  a repo-root exports/<name>/. export_dir remains an explicit override.

Tests cover both: missing optional asset errors, and the project-workspace
default path.

tests/tools/test_export_bundle.py

@@ -123,6 +123,31 @@ def test_infer_project_name(tmp_path):
     assert result.success is True
 
 
+def test_missing_optional_asset_errors(tmp_path):
+    video = tmp_path / "p" / "renders" / "final.mp4"
+    _make_video(video)
+    for key in ("subtitles_path", "thumbnail_path"):
+        result = ExportBundle().execute(
+            {
+                "video_path": str(video),
+                "title": "T",
+                "export_dir": str(tmp_path / "out"),
+                key: str(tmp_path / "does_not_exist.x"),
+            }
+        )
+        assert result.success is False, key
+        assert key in (result.error or "")
+
+
+def test_default_export_dir_inside_project_workspace(tmp_path):
+    # projects/<name>/renders/final.mp4 -> projects/<name>/exports (no export_dir given)
+    video = tmp_path / "projects" / "demo" / "renders" / "final.mp4"
+    _make_video(video)
+    result = ExportBundle().execute({"video_path": str(video), "title": "T"})
+    assert result.success is True
+    assert Path(result.data["export_path"]) == (tmp_path / "projects" / "demo" / "exports").resolve()
+
+
 def test_registry_discovers_export_bundle():
     reg = ToolRegistry()
     reg.discover()