Prefer security-focused state isolation across release workflows

When implementing or reviewing publish-workspace changes, ensure state-file handling is secure, deterministic, and consistently propagated across Craft and acceptance actions. Isolate publish-resume state by repository/path/version and selected workspace, use collision-safe encoding for workspace identifiers, reject unsafe paths/traversal, and avoid repository-writable legacy state. Inspect and update all producer/consumer contracts together, including workflow inputs, issue-title parsing, and issue-update lookup. Add or maintain regression tests for scoped and unscoped behavior, filename compatibility, malformed inputs, and state restoration.