Always enforce provenance-bound approval gates

Always bind release authorization and attestations to the exact live request, trusted actor, and current label-event provenance. Automated approval requires a request-bound github-actions[bot] proof before sentry-internal-app[bot] adds accepted; generic app identity is insufficient. A release whose request changes or whose accepted event is replaced must never reach ci-ready: validate the captured event and request digest before CI, after CI, while recording CI-ready proof, and immediately before adding ci-ready and before Craft. Chose repeated live fencing over initial validation because issue state changes during CI or setup.