Always verify approval attestations against current live state

When reviewing or modifying publish approval flows, ensure every attestation is request-bound and fail-closed. Verify the trusted comment author, exact issue title, digest of body and dry-run state, and the latest relevant label event’s actor and arbitrary-length event ID. Automated approvals must identify the expected auto-approver, and CI-ready proofs must bind both the accepted event and CI-ready actor. Treat missing, malformed, stale, wrongly typed, or mismatched attestations as invalid. Preserve tests showing that title/body/label changes, re-approval, newer label events, manual label application, or untrusted authors invalidate previous proofs.