publish.yml accepted-label revocation race

Trap: validating approval only when the publish job starts looks fail-closed because the initial issue/events/comments snapshot is valid, but labels, request content, or issue state can change during checkout and target setup before privileged Craft executes. Fix: require the live issue to remain open and re-run canonical approval plus CI-ready attestation validation immediately after Set targets and directly before Craft. The fence must verify current labels/events, request digest, and trusted proofs; immutable triggering-event payloads cannot prove current authorization.