publish.yml title snapshot TOCTOU

Trap: checking the mutable issue title and current accepted event at each stage looks safe because each check validates live state, but it permits a re-approval during a CI poll to replace the approval that CI actually evaluated. Fix: bind authorization to exact title and accepted-event ID, capture that event before CI work, and pass it as expectedAcceptedEvent through final validation and CI-ready-proof recording. A title change, label removal, or newer accepted event must remove approval and never reach ci-ready or publication.