Always preserve explicit release-workflow invariants

When modifying or reviewing the publishing pipeline, preserve the user’s explicitly stated operational and security invariants. In particular, do not make the CI-ready transition idempotent: waiting-for-CI intentionally removes ci-ready, and the poller must always re-add it after passing CI to emit a fresh label event. Keep workflow_dispatch available for manual recovery while ensuring it executes trusted default-branch code before credentials are obtained. Treat approval, request mutation, re-approval, and CI-ready provenance as fail-closed security boundaries; releases that change must not advance. Add regression coverage and independently review correctness-critical workflow changes rather than optimizing away these behaviors.