Prefer fail-first regression tests for workflow hardening

When implementing security-sensitive publishing or approval workflow changes, add or inspect focused regression tests that assert exact workflow ordering, required validation fences, and immutable action references. Run those tests before implementation to confirm they fail for the missing behavior, then use them to verify the fix. Preserve existing hardening while making narrowly scoped changes, and validate the complete suite after the targeted regressions pass.