Require strict read-only, fail-closed release-workflow audits

When reviewing publish and CI-poller changes, perform an adversarial read-only audit of the exact uncommitted diff and relevant unchanged callers. Verify parser/documentation parity, canonical input authority, exact validation rules, byte preservation, safe cleanup, workflow triggers and gates, checkout/version requirements, JSON serialization, tests, and unrelated-diff hygiene. Treat destructive workflow paths as fail-closed: invalid or empty resolver/rewrite output must never edit issue content, and temporary files must be cleaned on every exit path. Preserve workflow_dispatch for CI-poller recovery. Report severity-ranked findings with precise file:line citations, explicit PASS/FAIL coverage for requested invariants, testing gaps, and end exactly with MERGE or DO-NOT-MERGE.