fix(promote-rules): swap reserved kafka.publish audit steps to print …

[pigri]

…so the template installs per-tenant (422 fix)

What this PR adds

Tier

• Community (custom) — adds files under templates/custom/
• System (Gen0Sec only) — adds/edits files under templates/system/
  (maintainers only)

Checklist

• Template definition is at templates/<tier>/<slug>.json
• Sidecar metadata is at templates/<tier>/<slug>.meta.yaml
• meta.yaml author.kind matches the tier
  (gen0sec for system, anything else for custom)
• Template validates locally with go run ./scripts/build-manifest .
• No secrets / org-specific identifiers baked into the JSON
• Description in meta.yaml explains what the template does and
  when an operator would install it

Notes