Use exact CI-approved identities and authoritative state for Publish decisions

Use exact, lossless CI-approved checkout and workspace identities throughout Publish parsing, resolution, validation, discovery, titles, and state keys. New Craft requests include the checkout repository identity; preserve POSIX / paths and exact case. After checking out the CI-approved revision, classify a suffix as a workspace only by exact craft workspace list membership; retain nonmatches as checkout paths. A missing root .craft.yml means checkout-path behavior; fail closed when discovery is unreliable. Base decisions on authoritative runtime state, not normalization or mutable issue metadata, and account explicitly for GitHub Actions event semantics such as idempotent label updates.