Always enforce strict fail-closed publish-issue parsing

For Publish issue metadata and revision updates, accept only one canonical, tightly structured issue-body format. Anchor authority-bearing content at the start; require the expected Quick links structure with exactly one View check runs link; validate the requested repository and a 40-character lowercase SHA exactly; and reject missing, duplicate, malformed, forged, ambiguous, or repository-mismatched fields with explicit errors. Reuse validated extraction before updates and modify only the matched check-runs section. Add regressions for discovered bypasses and keep unrelated changes out of the branch.